I am using filebeat to ship logs into elasticsearch,
in the filebeat.yml, we can define number of primary shards of created index.
I am creating a weekly index as following:
and the size of logs (which their path defined in filebeat.yml in the filebeat.inputs part ) is around 50G per week. according these, how should i set the number of primary shards in the following part:
It is noted that, we will delete the indices that are alive more than 3 months