30 shards or daily index?


(Евгений) #1

What is better for performance - make 30 shards in index => ["prod-%{+YYYY.MM}"] or daily index like index => ["prod-%{+YYYY.MM.dd}"]?
P.s. I plan to use ELK for storing app logs for 2-3 years
P.p.s. Approximate amount of unziped logs now is 30GB/day


(Mark Walkom) #2

I would just use daily and make it a single shard.


(andy_zhou) #3

if use SSD a single shard if not two or three shards .
as my test HHD 30G is two large 10G -15G is better.


(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.