i have a few log files that are created daily,
i wanted to know what is the best way to ingest them,
should i create a new index with the current date for each log file, or just add them all to one big index.
i have dca.log.16.01.2018.log
should i create a new index every day ? or just create a index called "dca logs" and just add everything there ?
is there a limit for records in one index ? is there any advantage for splitting indexes?
what is the right way ?
i'm a noob in elk , and still trying to figure these thing up.