# Is there a source can explain deatiled thing about shards, nodes, clusters for better index and query for ELK?

**URL:** <https://discuss.elastic.co/t/is-there-a-source-can-explain-deatiled-thing-about-shards-nodes-clusters-for-better-index-and-query-for-elk/37262>\
**Category:** Elasticsearch\
**Created:** [December 15, 2015, 4:45pm UTC](https://discuss.elastic.co/t/is-there-a-source-can-explain-deatiled-thing-about-shards-nodes-clusters-for-better-index-and-query-for-elk/37262 "2015-12-15T16:45:31Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![shilong](https://avatars.discourse-cdn.com/v4/letter/s/f07891/32.png) [@shilong](https://discuss.elastic.co/u/shilong)\
**Post date:** [December 15, 2015, 4:45pm UTC](https://discuss.elastic.co/t/is-there-a-source-can-explain-deatiled-thing-about-shards-nodes-clusters-for-better-index-and-query-for-elk/37262/1 "2015-12-15T16:45:31Z")

</div>

Hi,  
I am wondering if I can create more nodes and clusters for better index via logstash for apache logs, and for better and faster query is it necessary to create more indices and clusters , is there a source can indicate this point? Thank you very much, the Kibana runing the query at the backend was extremely slow! I am at the dead end actually.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [December 15, 2015, 7:27pm UTC](https://discuss.elastic.co/t/is-there-a-source-can-explain-deatiled-thing-about-shards-nodes-clusters-for-better-index-and-query-for-elk/37262/2 "2015-12-15T19:27:29Z")

</div>

Horizontal scaling is one of Elasticsearch's main selling points, so yes, adding nodes is often a good way to increase performance. However, every case is different and adding nodes isn't always the best option. It depends on things like the hardware, the type of data, the query and indexing load, what kinds of queries, and so on.

I think the existing documentation at [elastic.co](http://elastic.co) does a pretty good job of explaining how Elasticsearch works and what to consider when designing indexes and sizing shards.

---

<div class="post-metadata">

**Author:** ![Yongyao\_Jiang](https://avatars.discourse-cdn.com/v4/letter/y/c4cdca/32.png) [@Yongyao\_Jiang](https://discuss.elastic.co/u/Yongyao_Jiang)\
**Post date:** [December 15, 2015, 8:07pm UTC](https://discuss.elastic.co/t/is-there-a-source-can-explain-deatiled-thing-about-shards-nodes-clusters-for-better-index-and-query-for-elk/37262/3 "2015-12-15T20:07:18Z")

</div>

I agree. What I want to add here is that in order to do so, you can use the automatic load balancing function provided by EC2 and Azure. And also, make sure you make full use of your existing hardware ([https://www.elastic.co/guide/en/elasticsearch/reference/1.4/setup-configuration.html](https://www.elastic.co/guide/en/elasticsearch/reference/1.4/setup-configuration.html)).

Hope it helps.

---

<div class="post-metadata">

**Author:** ![shilong](https://avatars.discourse-cdn.com/v4/letter/s/f07891/32.png) [@shilong](https://discuss.elastic.co/u/shilong)\
**Post date:** [December 15, 2015, 9:39pm UTC](https://discuss.elastic.co/t/is-there-a-source-can-explain-deatiled-thing-about-shards-nodes-clusters-for-better-index-and-query-for-elk/37262/4 "2015-12-15T21:39:58Z")

</div>

thanks , do you mean that a whole standalone server totally for Kibana (even elasticsearch)?

---

<div class="post-metadata">

**Author:** ![Yongyao\_Jiang](https://avatars.discourse-cdn.com/v4/letter/y/c4cdca/32.png) [@Yongyao\_Jiang](https://discuss.elastic.co/u/Yongyao_Jiang)\
**Post date:** [December 16, 2015, 1:57am UTC](https://discuss.elastic.co/t/is-there-a-source-can-explain-deatiled-thing-about-shards-nodes-clusters-for-better-index-and-query-for-elk/37262/5 "2015-12-16T01:57:28Z")

</div>

It sounds like you need a cluster for ES. I don't think Kibana has anything to do with the speed, since it's just a front end that generates query to ES. Shard is usually managed by ES automatically. If you don't want to the define the number of primary and replica, which needs some experiments, there is no need to touch it.

For Logstash, I don't know too much, but I have seen some people say additional config is needed when data goes big.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 11:30pm UTC](https://discuss.elastic.co/t/is-there-a-source-can-explain-deatiled-thing-about-shards-nodes-clusters-for-better-index-and-query-for-elk/37262/6 "2017-07-05T23:30:46Z")

</div>


