Let me explain the problem which I am trying to address:
We have a system to store logs per user and each user produces around few
Terabytes of logs per day. I have growing number of users, as per
guidelines I can split the indices per day or per user however, I am
thinking to create indices per account and per day so the index name
that means the number of indices will be (users * no_of_days). So question
begs is how many indices ES can support?
The reason why i am creating index per user and per day is because of
purging data policies. Each user logs can retained for certain number of
days. So I assumed that its easier to delete whole index pertaining to that
user and day. Other approach I can use is just create indices based on days
and have log data store the username as one of the fields in document type
and issue a query to bulk delete the logs with timestamp greater than
retention period. I assume that the later approach is much expensive than
deleting just the index. Is my assumption correct?
Thanks in advance.
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to email@example.com.
For more options, visit https://groups.google.com/groups/opt_out.