# Choosing shard vs alice in elasticsearch **URL:** \ **Category:** Elasticsearch\ **Created:** [March 21, 2014, 4:41am UTC](https://discuss.elastic.co/t/choosing-shard-vs-alice-in-elasticsearch/16512 "2014-03-21T04:41:53Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Chetana](https://avatars.discourse-cdn.com/v4/letter/c/dbc845/32.png) [@Chetana](https://discuss.elastic.co/u/Chetana)\ **Post date:** [March 21, 2014, 4:41am UTC](https://discuss.elastic.co/t/choosing-shard-vs-alice-in-elasticsearch/16512/1 "2014-03-21T04:41:53Z")
I am planning to use elasticsearch (ES) for storing event logs. Per day, the application should store nearly 3000+ events and size will be around 30-50K. I need to take some statistics monthly, half yearly, yearly.... also year old data can be ignored sometimes but data should be retained for many years I want to know the best practices in this scenario 1. Is it a good idea to create shards based on size/period or create one shard with multiple alices based on filter condition? 2. Does ES merges the search results coming from multiple shards? If yes, how fast or better it is compared to lucene's ranking based on Vector space model? -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/cafc1166-549e-41b2-bf64-e8966f2e610a%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/cafc1166-549e-41b2-bf64-e8966f2e610a%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![Chetana](https://avatars.discourse-cdn.com/v4/letter/c/dbc845/32.png) [@Chetana](https://discuss.elastic.co/u/Chetana)\ **Post date:** [March 21, 2014, 6:17am UTC](https://discuss.elastic.co/t/choosing-shard-vs-alice-in-elasticsearch/16512/2 "2014-03-21T06:17:33Z")
Sorry it is alias not alice On Friday, March 21, 2014 10:11:53 AM UTC+5:30, Chetana wrote: > I am planning to use elasticsearch (ES) for storing event logs. Per day, > the application should store nearly 3000+ events and size will be around > 30-50K. > I need to take some statistics monthly, half yearly, yearly.... also year > old data can be ignored sometimes but data should be retained for many years > I want to know the best practices in this scenario > > 1. Is it a good idea to create shards based on size/period or create one > shard with multiple aliases based on filter condition? > 2. Does ES merges the search results coming from multiple shards? If yes, > how fast or better it is compared to lucene's ranking based on Vector space > model? -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/4eac5bd8-0294-4a91-b5e4-2f60e0f9878b%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/4eac5bd8-0294-4a91-b5e4-2f60e0f9878b%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![jpountz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jpountz/32/45836_2.png) [@jpountz](https://discuss.elastic.co/u/jpountz)\ **Post date:** [March 21, 2014, 9:07am UTC](https://discuss.elastic.co/t/choosing-shard-vs-alice-in-elasticsearch/16512/3 "2014-03-21T09:07:07Z")
On Fri, Mar 21, 2014 at 5:41 AM, Chetana [ambha.career@gmail.com](mailto:ambha.career@gmail.com) wrote: > 1. Is it a good idea to create shards based on size/period or create one > shard with multiple alices based on filter condition? I would recommend on using time-based indices, you can hear about the rationale at [Elasticsearch Platform — Find real-time answers at scale | Elastic](http://www.elasticsearch.org/videos/big-data-search-and-analytics/) (the part you are interested in starts at 21:15 but I would recommend wathing the whole video which gives interesting ideas about how to model data with Elasticsearch). For example, you could imagine build monthly indices. Then tools like curator can help you manage old indices, in order to force-merge (optimize) the read-only onces and deletes the old ones. > 1. Does ES merges the search results coming from multiple shards? If yes, > how fast or better it is compared to lucene's ranking based on Vector space > model? Indeed, Elasticsearch merges search results: each shard returns its top hits (via Lucene) and the node that coordinates search execution merges these per-shard top-hits based on a priority queue. -- Adrien Grand -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CAL6Z4j7WvMMUGKkKGomW\_djU3Hck-jbAYbTBj%3DYCLHUtaDng4g%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAL6Z4j7WvMMUGKkKGomW_djU3Hck-jbAYbTBj%3DYCLHUtaDng4g%40mail.gmail.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 1:41am UTC](https://discuss.elastic.co/t/choosing-shard-vs-alice-in-elasticsearch/16512/4 "2017-07-06T01:41:37Z")