One or multiple metricbeat indices?

[rodri.gz (RGZ-ELK)]

Hi there.

I am installing machines with metricbeat to measure metrics. At the time of implementing it, I have the doubt if it is better to have a single index ({Agent} - {version}) or multiple indexes
({Agent} -{version} - {hostname} - {timestamp}.

Thank you in advanced!

[warkolm (Mark Walkom)]

I'd stick with a single index, otherwise you are going to end up with too many shards.

[rodri.gz (RGZ-ELK)]

@warkolm

I'd stick with a single index, otherwise you are going to end up with too many shards.

for elk performance would also be better? have large index couldn't be a problem? without dates, do the policies apply the same?

[warkolm (Mark Walkom)]

It depends on what version you are on, never ones use ILM which will mean your indices (shards) won't get excessively large.