I'm exploring the automatic rollover for ILM and are looking for some sensible default when to rollover. max_age is straight forward e.g. 1 day, 7 days e.g. 1 month. When it comes to max_size I'll guess it depends. But let's pretend I'd like to shrink my index to 1 shard when it hits the warm phase 20GB could be a sensible default, https://www.elastic.co/blog/how-many-shards-should-i-have-in-my-elasticsearch-cluster so we're not ending up with a too large single shard in the index.
When it comes to number of documents I haven't found any real guide lines but this post indicates 3M per shard https://thoughts.t37.net/designing-the-perfect-elasticsearch-cluster-the-almost-definitive-guide-e614eabc1a87#3615 but I'll guess it depends as well. My logs are typically either request logs or structured application logs. Are there any other resources/benchmarks for how to select the number of documents?