Hi all,
we are running a single of elk.
We have 3 indexes prefixes, each holding information of some logfile types.
On single node, will more shards improve speed (especially on searching data via kibana)?
Thanks, Andreas
As each query/aggregation runs single-threaded against a shard, but shards can be processed in parallel, the shard size will affect the minimum query latency. Having a large number of small shards however a lot of shards to be searched, which can slow down queries significantly as well. This is why we generally recommend you benchmark in order to find the ideal shard size, as this can differ depending on your data and queries/aggregations against this data.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.