Number of primary shards

(sahere rahimi) #1

I am using filebeat to ship logs into elasticsearch,
in the filebeat.yml, we can define number of primary shards of created index.
I am creating a weekly index as following:
index: "myn-%{+yyyy.ww}"

and the size of logs (which their path defined in filebeat.yml in the filebeat.inputs part ) is around 50G per week. according these, how should i set the number of primary shards in the following part:
index.number_of_shards: ?

It is noted that, we will delete the indices that are alive more than 3 months

(Mark Walkom) #2

I would set it to 2, that gives you some room to grow.

(sahere rahimi) #3

thanks, the default is 3, should i used less than 3?

(Mark Walkom) #4

If you're asking the question then you care enough to get an answer right :wink:

If so, then yes, go with 2. And then when you start to get ~100GB indices then move to 3.

(sahere rahimi) #5

Many thanks