I have a legacy index created a few years ago before I better understood index management and looking for a recommendation to address the problem.
I am looking at the least impactful way/time intensive way to add the new pattern, update all existing visualizations and also reindex the data
Right now its one fat index with no partition strategy e.g. no YYYY-MM-DD. The index name is like bigfatstupidindex
On average I get around 10 Million events in the index per month and thinking of moving to indexname-YYYY.MM
the current stats of my fat index:
- 74GB storage size - 37GB primary
- 76 Million Documents
- 22 Million Deletes Documents
My understanding the way i'd have to address this:
- Create the index pattern
- Update my logstash ingestion pipeline
- Use re-index API (want to confirm?) to put into new indexes by indexname-YYYY.MM
- Find all applicable visualizations and update
Any suggestions welcome.