# Is greates store logs into one indice or store in N small indices?
**URL:** https://discuss.elastic.co/t/is-greates-store-logs-into-one-indice-or-store-in-n-small-indices/277588
**Category:** Elasticsearch
**Created:** [July 1, 2021, 6:34pm UTC](https://discuss.elastic.co/t/is-greates-store-logs-into-one-indice-or-store-in-n-small-indices/277588 "2021-07-01T18:34:43Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@guimap](https://discuss.elastic.co/u/guimap)
#### Post date: [July 1, 2021, 6:34pm UTC](https://discuss.elastic.co/t/is-greates-store-logs-into-one-indice-or-store-in-n-small-indices/277588/1 "2021-07-01T18:34:43Z")
Hi
I was wondering which is greatest way to store logs data, store into only one indice ( maybe use ILM to manager this indice ) or split in small indices (like: logs-2021.07.01, logs-2021.07.02 etc)
What the greatest way, which one is recommend ?
There's any impact in performance if i choose the big one indice option?
Considering that elasticsearch has a limited number of shards (where the number are limited by number of nodes, right ? )
Thanks 🙂
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [July 1, 2021, 6:41pm UTC](https://discuss.elastic.co/t/is-greates-store-logs-into-one-indice-or-store-in-n-small-indices/277588/2 "2021-07-01T18:41:15Z")
If you have log data you generally want to use time-based indices as this makes managing retention by deleting indices very efficient. Deleting from a single large index is quite costly. That said you want to make sure that your shards are not too small (aim for a few tens of GB in size as a guideline) so maybe you want to use rollover or have weekly or monthly indices depending on how much data you ingest per day.
---
### Author:  [@guimap](https://discuss.elastic.co/u/guimap)
#### Post date: [July 1, 2021, 6:50pm UTC](https://discuss.elastic.co/t/is-greates-store-logs-into-one-indice-or-store-in-n-small-indices/277588/3 "2021-07-01T18:50:55Z")
Thanks for reply 🙂
I have a large number of documents per index (like 6kk per index)
Just for context:
Today i'm saving my logs into small indices, splitted by day, But this are consuming my shards limitation,
Can i save this logs into weekly indices instead of save it into daily indices (saving my shards limitation ) ?
And maybe use ILM to retention old indices ?
What do you recommend ?
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [July 1, 2021, 7:15pm UTC](https://discuss.elastic.co/t/is-greates-store-logs-into-one-indice-or-store-in-n-small-indices/277588/4 "2021-07-01T19:15:40Z")
Use time based indices but do not use daily indices if they end up being small. Instead use ILM with rollover to get to a good target size and have each index cover a longer time period.
---
### Author:  [@guimap](https://discuss.elastic.co/u/guimap)
#### Post date: [July 1, 2021, 10:14pm UTC](https://discuss.elastic.co/t/is-greates-store-logs-into-one-indice-or-store-in-n-small-indices/277588/5 "2021-07-01T22:14:05Z")
> [@Christian\_Dahlqvist](#):
>
> Use time based indices but do not use daily indices if they end up being small. Instead use ILM with rollover to get to a good target size and have each index cover a longer time period.
Thanks, thats what i will do.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 29, 2021, 10:15pm UTC](https://discuss.elastic.co/t/is-greates-store-logs-into-one-indice-or-store-in-n-small-indices/277588/6 "2021-07-29T22:15:00Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.