Shards and replica for logs

Elastic Stack Elasticsearch
1

Just curious what's the best option for ingesting static logs by balancing performance and availability. The default is 5 shards w/ 1 replica.

Since new index will be created at daily based does it make sense to have a small shards, like 3 shards with 1 replica? I wonder what is the threshold to decide the best of it. Is it the volume of the data ingestion or something else.

Thanks in advance.

2

This blog post provides some guidance on shards and sharding and may be useful. It does however often depend on the use case, types of data and retention period.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.