# Indexing different type logs

**URL:** <https://discuss.elastic.co/t/indexing-different-type-logs/127877>\
**Category:** Elasticsearch\
**Created:** [April 12, 2018, 8:45pm UTC](https://discuss.elastic.co/t/indexing-different-type-logs/127877 "2018-04-12T20:45:28Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sebastian\_Herrera](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sebastian_herrera/32/53209_2.png) [@Sebastian\_Herrera](https://discuss.elastic.co/u/Sebastian_Herrera)\
**Post date:** [April 12, 2018, 8:45pm UTC](https://discuss.elastic.co/t/indexing-different-type-logs/127877/1 "2018-04-12T20:45:29Z")

</div>

Hi guys, i am parsing syslog logs from different sources (firewal, polyphone,etc), my question is what is better, to use only one index or have multiple index (one per source)

Regards

---

<div class="post-metadata">

**Author:** ![thiago](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thiago/32/32096_2.png) [@thiago](https://discuss.elastic.co/u/thiago)\
**Post date:** [April 15, 2018, 3:24am UTC](https://discuss.elastic.co/t/indexing-different-type-logs/127877/2 "2018-04-15T03:24:47Z")

</div>

It's difficult to say what is better without knowing more of your use case, so I will provide you the key points for you to think about so you can figure out.

The main point in this decision is the [index shard](https://www.elastic.co/guide/en/elasticsearch/reference/6.2/_basic_concepts.html#getting-started-shards-and-replicas) that will use resources. You need to keep the shard count per node under control, otherwise the nodes will eventually suffer memory pressure. That being said:

1. If you use an index per type, while you will gain a finer-grained control of retention period per type, it can potentially create a shard count per node explosion.
2. If you use a single index pattern for all types, it will be easier to keep shard count per node under control, but then you need to live with a single retention period for all the types.

Additionally, checkout this article for more insights on this subject: [https://www.elastic.co/blog/how-many-shards-should-i-have-in-my-elasticsearch-cluster](https://www.elastic.co/blog/how-many-shards-should-i-have-in-my-elasticsearch-cluster)

Hope that helps!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 13, 2018, 3:24am UTC](https://discuss.elastic.co/t/indexing-different-type-logs/127877/3 "2018-05-13T03:24:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.