How many indices / shards for graylog

Elastic Stack Elasticsearch
1

Hi there,

I'm running Graylog which uses Elasticsearch as backend. RIght now we have about 1.5TB data (about 2 weeks of logging) and I've created 10G indices (about 120 in total, I expect, it's still a process) and 4 shards. Is this a sane number? How can I find out what the best settings for indices (size) and shards are?

kind regards,

Léon

2

I'd probably go for 3 primary, keeps it under the 50GB max recommendation and gives you room to grow.