Best practices for fine tuning performance when it comes to Elasticsearch, Logstash and Kibana?

Yes, but you can copy from multiple indices into one. eg winlogbeat-windows-winsecurity-2021.01.* > winlogbeat-windows-winsecurity-2021.01.

More efficient resource use.

Ideally, you should switch to ILM.

Oh, my mistake about being able to copy from multiple indexes :slight_smile: Also wouldnt consume that much time....

I currently use ILM to delete my indexes after 180 days BUT I believe I only use it for that....

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.