# Rotate indice daily to hourly

**URL:** <https://discuss.elastic.co/t/rotate-indice-daily-to-hourly/146251>\
**Category:** Elasticsearch\
**Created:** [August 27, 2018, 11:36pm UTC](https://discuss.elastic.co/t/rotate-indice-daily-to-hourly/146251 "2018-08-27T23:36:32Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![dis](https://avatars.discourse-cdn.com/v4/letter/d/e99b99/32.png) [@dis](https://discuss.elastic.co/u/dis)\
**Post date:** [August 27, 2018, 11:36pm UTC](https://discuss.elastic.co/t/rotate-indice-daily-to-hourly/146251/1 "2018-08-27T23:36:32Z")

</div>

Can someone point me to info on configure elasticsearch to roll over indice from daily to hourly?

Using elasticsearch 6.2.4. The current index is created from fluentd (logstash\_format=true) with timestring '%Y.%m.%d'.

Thanks.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [August 27, 2018, 11:39pm UTC](https://discuss.elastic.co/t/rotate-indice-daily-to-hourly/146251/2 "2018-08-27T23:39:08Z")

</div>

Do you have enough data volumes to warrant this?  
If you don't then you're going to be wasting a fair bit of resources on shards is all.

---

<div class="post-metadata">

**Author:** ![dis](https://avatars.discourse-cdn.com/v4/letter/d/e99b99/32.png) [@dis](https://discuss.elastic.co/u/dis)\
**Post date:** [August 28, 2018, 4:59am UTC](https://discuss.elastic.co/t/rotate-indice-daily-to-hourly/146251/3 "2018-08-28T04:59:27Z")

</div>

Yes there is enough data (7-10 GB) to at the least investigate the give and take. I would like to configure the rollover to hourly and determine if hourly or daily.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [August 28, 2018, 5:07am UTC](https://discuss.elastic.co/t/rotate-indice-daily-to-hourly/146251/4 "2018-08-28T05:07:41Z")

</div>

That's not really worth it, you're going to be way over-sharded.

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [August 28, 2018, 5:16am UTC](https://discuss.elastic.co/t/rotate-indice-daily-to-hourly/146251/5 "2018-08-28T05:16:22Z")

</div>

Hourly indices can work if you have very large data volumes (multiple TB/day) and relatively short retention periods. As described in [this blog post](https://www.elastic.co/blog/how-many-shards-should-i-have-in-my-elasticsearch-cluster) having lots of small indices and shards can be very inefficient, but each separate index also carries additional overhead in terms of mappings, that need to be stored on the cluster state.

That said, if you are using index names with a date string in the name, this is generally controlled by the application writing to Elasticsearch, in this case FluentD, so that is where you would need to configure it. It would be different if you were using the [rollover index API](https://www.elastic.co/guide/en/elasticsearch/reference/6.4/indices-rollover-index.html).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 25, 2018, 5:16am UTC](https://discuss.elastic.co/t/rotate-indice-daily-to-hourly/146251/6 "2018-09-25T05:16:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.