environment:
OS: Windows Server 2019
CORE: 4-Core
RAM: 8GB
HDD: 60GB
elasticsearch: 7.3.0
kibana:7.3.0
JVM:4GB
One cluster, one node
I put the sql server trace log data (last 7 days) into elasticsearch and show some analysis result in dashboard.
There are six dbs, and total doc in one day less then 100,000.
I have two plans, and I want know WHICH ONE is better:
- Generate SIX indices everyday (one db one index), each index setting is shown as below. (I just reference online configuration)
2.Generate ONE index everyday (6 dbs in one index), the setting is unchanging
Each index one shard(default setting) and no replicas. (I don't know why if I set replicas. the cluster health will change to yellow because of the unassigned shards)
{
"index.blocks.read_only_allow_delete": "false",
"index.priority": "1",
"index.query.default_field": ["*"],
"index.mapping.nested_fields.limit": "50",
"index.mapping.nested_objects.limit": "10000",
"index.mapping.depth.limit": "20",
"index.mapping.total_fields.limit": "1000",
"index.refresh_interval": "1s",
"index.translog.sync_interval": "120s",
"index.translog.durability": "async",
"index.auto_expand_replicas": "0-1",
"index.merge.scheduler.max_thread_count": "1",
"index.number_of_replicas": "0",
"index.write.wait_for_active_shards": "1"
}