Clarification on index by day and automatically closing them

Elastic Stack Elasticsearch
1

Hello,

I didn't undertstand quite much about the index by day output in logstash. Will it not result in a tremendious amount of existing indexes overtime ? Isn't that a problem ?
Also, will those indexes be closed automatically everyday, or will they stay active unless I close them manually ? Because then the shards for those indexes will still be active right ?

Thanks for the insights !

2

Do you need to keep all data around forever?
If not just use curator to remove old indices every day.
You can also change Logstash default index name pattern and create indices per month if you wish.

3

We would need to keep data for one year.
I will consider using an index per month.
Thanks.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.