How many shards in one node?

Elastic Stack Elasticsearch
1

Hello,
i have install the ELK Stack for apache and php logs. My logstash is connect to my elasticsearch.
At present, logstash create a daily index for elasticsearch.

I have 600Mb of logs per day, and we want to keep the logs for 30 days ( ~18 Gb).
The shards can't support 45Gb of data, but it is a good things to have just one shards per daily index ?

Because i dont know if the best is too create juste one index logstash with 5 shards of 3.6Gb or create a daily index with just one shards of 600Mo (it's easier to delete index to old after 30 days than data on shards ?)

Ps : i have just one node

Thkssssss

2

Single daily index with 1 primary shards sounds reasonable.

1 Like
3

Okey, but 30 shards (1 shard per dayly index) it is ok for just one node ? it's not to big for this basic architecture ?

4

Yes, I think that sounds reasonable, although you could also go with e.g. weekly indices. Have a look at this blog post about shards and sharding.

1 Like
5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.