Just curious what's the best option for ingesting static logs by balancing performance and availability. The default is 5 shards w/ 1 replica.
Since new index will be created at daily based does it make sense to have a small shards, like 3 shards with 1 replica? I wonder what is the threshold to decide the best of it. Is it the volume of the data ingestion or something else.
Thanks in advance.