Should i create daily index or weekly?

Elastic Stack Elasticsearch
1

I have three node cluster(1 master node and two data node). currently i am creating weekly index with 3 shards and 1 replica.and size of weekly index is around 40-50 gb. and its working fine for us.

but now we have another new requirement with daily log size of around100gb (it can grow upto 500gb after 2-3 months) . i have tried with weekly index but its creating performance issue(slowness, timeout, etc)

Can you please suggest me that should i increase number of shards or create daily basis index with 3 shards.

2

This is a bad setup. You should always have at least 3 master-eligible nodes, so I would recommend changing this to 3 master/data nodes or 1 dedicated master node and 2 master/data nodes).

The easy way to manage changing volumes, especially for time-series data that is not updated, is to use rollover and ILM. Rollover allows you to specify maximum size and age and then create a new index whichever comes first. When you have volumes that do not trigger the size threshold you can get weekly indices and once volumes ramp up each index will cover a shorter time period and instead aim for the target size.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.