Index size and shards

Elastic Stack Elasticsearch
1

Hello, I've got an index for syslog events from a Cisco firewall - when I run GET /syslogcisco-2017.06/_stats/store I get the following output:

{
  "_shards": {
    "total": 6,
    "successful": 6,
    "failed": 0
  },
  "_all": {
    "primaries": {
      "store": {
        "size_in_bytes": 9114820610,
        "throttle_time_in_millis": 0
      }
    },
    "total": {
      "store": {
        "size_in_bytes": 17411633378,
        "throttle_time_in_millis": 0
      }
    }
  },
  "indices": {
    "syslogcisco-2017.06": {
      "primaries": {
        "store": {
          "size_in_bytes": 9114820610,
          "throttle_time_in_millis": 0
        }
      },
      "total": {
        "store": {
          "size_in_bytes": 17411633378,
          "throttle_time_in_millis": 0
        }
      }
    }
  }
}

I am wondering which statistic to use for the total size of the index and does that include all shards or are the size stats per shard?

Thanks.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.