One large index vs split indexes

Searching, as a general concept, is always faster on a single shard. But unless you are dealing with massive amounts of data, eg TBs per user, then in reality it may be the difference of a few hundred milliseconds. If that's super important to you, then you should test that and see what is best for you. I'd suggest it's not something you need to be overly worried about at your scale.

Why not create an ILM pattern per user? It'll cover your mapping requirements, and if this is transactional data then you should expect growth, which ILM will also help with.

1 Like