I'm running Graylog which uses Elasticsearch as backend. RIght now we have about 1.5TB data (about 2 weeks of logging) and I've created 10G indices (about 120 in total, I expect, it's still a process) and 4 shards. Is this a sane number? How can I find out what the best settings for indices (size) and shards are?
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.