I am currently devising a new sharding strategy for my work. One of the things that we are considering doing in order to greatly reduce the number of shards that we process, is consolidating a large number of our small indices into a single index. I have two primary questions, particularly regarding index templates:
- If we change all of our template mappings to map to the new consolidated index, elasticsearch documentation states:
Multiple index templates can potentially match an index, in this case, both the settings and mappings are merged into the final configuration of the index. The order of the merging can be controlled using the order parameter, with lower order being applied first, and higher orders overriding them.
In the case that templates of the same order have the same mapping, or two dynamic templates of the same order match to a field, what logic is applied to determine which mapping will take precedence??
- If we consolidate all of these indices into one large index, this will make for an index mapping which is an order of magnitude larger than our previous mappings. Is this likely to have any impact on my queries in kibana, or in aggregations used in kibana dashboards?? If not, where might this possibly have an impact??
Help appreciated.. Thank you!!