# Pros & Cons For Single Index vs. Per-Device Index

**URL:** <https://discuss.elastic.co/t/pros-cons-for-single-index-vs-per-device-index/369381>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [October 24, 2024, 6:53pm UTC](https://discuss.elastic.co/t/pros-cons-for-single-index-vs-per-device-index/369381 "2024-10-24T18:53:35Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Michael\_O\_Hara](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/michael_o_hara/32/134335_2.png) [@Michael\_O\_Hara](https://discuss.elastic.co/u/Michael_O_Hara)\
**Post date:** [October 24, 2024, 6:53pm UTC](https://discuss.elastic.co/t/pros-cons-for-single-index-vs-per-device-index/369381/1 "2024-10-24T18:53:36Z")

</div>

Can SME's for Beats-Elastic chime in on this: what are the pros/cons that would help decide whether to deploy a single index vs. per-device index?

Effort required to set up on single vs. per-server?  
Risks of using a single index?

In the interest of not feeling more pain down the road we'd like to make the right decision upfront...

---

<div class="post-metadata">

**Author:** ![rugenl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rugenl/32/12887_2.png) [@rugenl](https://discuss.elastic.co/u/rugenl)\
**Post date:** [October 24, 2024, 7:19pm UTC](https://discuss.elastic.co/t/pros-cons-for-single-index-vs-per-device-index/369381/2 "2024-10-24T19:19:08Z")

</div>

Per device? So each server would have it's own index? Bad idea.... Very bad... I think this is the latest way [An introduction to the Elastic data stream naming scheme | Elastic Blog](https://www.elastic.co/blog/an-introduction-to-the-elastic-data-stream-naming-scheme)

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [October 24, 2024, 7:24pm UTC](https://discuss.elastic.co/t/pros-cons-for-single-index-vs-per-device-index/369381/3 "2024-10-24T19:24:57Z")

</div>

A per-device index approach was always a bad idea as it can lead to a cluster having many small indices.

Now with Elastic Agent and integrations it is even a worst idea as it would add a lot more of complexity to even get the logs in the cluster.

I would say that the way to go now is to use the Elastic Agent integrations when possible as it will keep the size of the shards close the recommendations (50 GB per shard).

If it is not possible to use Elastic Agent integrations, then you should try to use data streams and Index Lifecycle Policies to keep the shard sizes close the recommendations.

Of course, there would be no problem to group your devices into smaller parts, like store the data of all AD servers in the same index and things like that.