Best practice index naming

Elastic Stack Elasticsearch
1

Hi everyone,
I started learning about Elasticsearch last week and I found it great.
I noticed that by default Logstash ( yes we want to use elastic for storing logs, but I guess we will go further than storing logs) names indexes as myindex_yyyy.mm.dd.
What is the purpose of this approach, what is the benefit ?
I found that we can easily search by indexes like myindex__* or myindex_2015.*.
So, my main question is: why is that set by default, do I have to do the same? What will be different if I name index just myindex without date ?

Best, Ihor.

1 Like
2

The main reason for using time based indices is that it is an easy and efficient way to manage retention of data, as described here. Another side effect of this is that queries can be made to just hit the shards that hold data for a specific time period, which can improve performance.

3 Likes