One or multiple metricbeat indices?

Hi there.

I am installing machines with metricbeat to measure metrics. At the time of implementing it, I have the doubt if it is better to have a single index ({Agent} - {version}) or multiple indexes
({Agent} -{version} - {hostname} - {timestamp}.

Thank you in advanced!

I'd stick with a single index, otherwise you are going to end up with too many shards.

for elk performance would also be better? have large index couldn't be a problem? without dates, do the policies apply the same?

It depends on what version you are on, never ones use ILM which will mean your indices (shards) won't get excessively large.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.