We have a logs data which goes to elastic search cluster holding around 180 shards and 1 tB of data on each data node of total 3 data nodes cluster.
- I want to take the snapshot of all indices. What is the best practice? Should I take it daily or hourly? What is the impact on performance in each case.
- How soon I should run curator job for these i.e. every hour or twice daily or daily to get the best performance?
We are deleting the old indices older than 15 days. Thanks.