# Hourly rotation of ArcSight Indexes

**URL:** <https://discuss.elastic.co/t/hourly-rotation-of-arcsight-indexes/164966>\
**Category:** Logstash\
**Created:** [January 21, 2019, 12:14am UTC](https://discuss.elastic.co/t/hourly-rotation-of-arcsight-indexes/164966 "2019-01-21T00:14:48Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![fpieressa](https://avatars.discourse-cdn.com/v4/letter/f/ba8739/32.png) [@fpieressa](https://discuss.elastic.co/u/fpieressa)\
**Post date:** [January 21, 2019, 12:14am UTC](https://discuss.elastic.co/t/hourly-rotation-of-arcsight-indexes/164966/1 "2019-01-21T00:14:48Z")

</div>

Hi! We are trying the Logstash ArcSight Module, and we are seeing it creates indexes like arcsight-yyyy.mm.dd, where yyyy-mm-dd is extracted from the deviceReceiveTime field of the CEF event.

Is there any way to configure it to index like arcsight-yyyy.mm.dd.hh, to have one index per hour per day?

We can't find the logstash output configuration, as it's embedded in the Module...

Thanks!

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [January 21, 2019, 1:01am UTC](https://discuss.elastic.co/t/hourly-rotation-of-arcsight-indexes/164966/2 "2019-01-21T01:01:05Z")

</div>

Why would you want to do that? How much data do you have being indexed per hour? Be aware that having lots of small indices and shards in the cluster [is very inefficient](https://www.elastic.co/blog/how-many-shards-should-i-have-in-my-elasticsearch-cluster).

---

<div class="post-metadata">

**Author:** ![fpieressa](https://avatars.discourse-cdn.com/v4/letter/f/ba8739/32.png) [@fpieressa](https://discuss.elastic.co/u/fpieressa)\
**Post date:** [January 22, 2019, 11:06am UTC](https://discuss.elastic.co/t/hourly-rotation-of-arcsight-indexes/164966/3 "2019-01-22T11:06:03Z")

</div>

Hi! Thanks for your quick answer, we expected aprox 50 GB per day, could be that with a daily index rotation will be enought, but we want also understand how Logstash ArcSight module works. Is there any way to tune it, outside the well know parameters documented?

Thanks!

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [January 22, 2019, 11:08am UTC](https://discuss.elastic.co/t/hourly-rotation-of-arcsight-indexes/164966/4 "2019-01-22T11:08:23Z")

</div>

50GB data per day should work with a single daily index with one or two primary shards.

> [@fpieressa](#):
>
> Is there any way to tune it, outside the well know parameters documented?

This is a very broad question. Are you experiencing any performance problems?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 19, 2019, 11:08am UTC](https://discuss.elastic.co/t/hourly-rotation-of-arcsight-indexes/164966/5 "2019-02-19T11:08:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.