As deleting documents from an index is 'expensive', it is generally recommended that data that have different retention periods are placed into different indices so that retention period and data deletion can be handled by dropping entire indices. You also generally want to store logs that are similar structure (assuming same retention period) in the same index. This also means that you can have weekly or even monthly indices for data that arrives in lower volumes but need to be kept long, and thereby reduce the overall shard count.