Elasticsearch index problem

OS: Windows Server 2019
CORE: 4-Core
elasticsearch: 7.3.0

One cluster, one node

I put the sql server trace log data (last 7 days) into elasticsearch and show some analysis result in dashboard.
There are six dbs, and total doc in one day less then 100,000.

I have two plans, and I want know WHICH ONE is better:

  1. Generate SIX indices everyday (one db one index), each index setting is shown as below. (I just reference online configuration)

2.Generate ONE index everyday (6 dbs in one index), the setting is unchanging

Each index one shard(default setting) and no replicas. (I don't know why if I set replicas. the cluster health will change to yellow because of the unassigned shards)

	"index.blocks.read_only_allow_delete": "false",
	"index.priority": "1",
	"index.query.default_field": ["*"],
	"index.mapping.nested_fields.limit": "50",
	"index.mapping.nested_objects.limit": "10000",
	"index.mapping.depth.limit": "20",
	"index.mapping.total_fields.limit": "1000",
	"index.refresh_interval": "1s",
	"index.translog.sync_interval": "120s",
	"index.translog.durability": "async",
	"index.auto_expand_replicas": "0-1",
	"index.merge.scheduler.max_thread_count": "1",
	"index.number_of_replicas": "0",
	"index.write.wait_for_active_shards": "1"

Fewer indices are usually better.

A replica can't be on the same node as the primary, so on a one-node system, if you ask for replicas, you get yellow.

Thank you very much. I got it :smile:

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.