# Should you split indexes by category

**URL:** <https://discuss.elastic.co/t/should-you-split-indexes-by-category/36424>\
**Category:** Elasticsearch\
**Created:** [December 4, 2015, 10:12pm UTC](https://discuss.elastic.co/t/should-you-split-indexes-by-category/36424 "2015-12-04T22:12:50Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![spuder](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spuder/32/44895_2.png) [@spuder](https://discuss.elastic.co/u/spuder)\
**Post date:** [December 4, 2015, 10:12pm UTC](https://discuss.elastic.co/t/should-you-split-indexes-by-category/36424/1 "2015-12-04T22:12:50Z")

</div>

I've been researching this for quite a while and asking people in the community. I'm finding very conflicting responses.

I have several types of servers all pushing logs to several kafka topics

- mail
- web
- indexing
- database

Currently I have all these topics pushing to daily logstash indexes

logstash.{YYYY-MM-DD}

Doing about 10GB of data per day across 3 elasticsearch nodes. This will be increasing to about 100GB per day soon. The intended use case is to let IT and Developers look through logs easily.

Is it best practice to have all topics report to one index, or to create an index for each server type / kafka topic?

Splitting indexes makes data more contained, but comes at a higher administrative cost. (Having to run multiple curators per day)

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [December 4, 2015, 11:58pm UTC](https://discuss.elastic.co/t/should-you-split-indexes-by-category/36424/2 "2015-12-04T23:58:57Z")

</div>

Depends. Are the formats all similar, do you have similar fields with conflicting mappings (see [GitHub - elastic/elasticsearch-migration: This plugin will help you to check whether you can upgrade directly to the next major version of Elasticsearch, or whether you need to make changes to your data and cluster before doing so.](https://github.com/elastic/elasticsearch-migration))?

But I'd suggest it makes more sense to split them because then you can better allocate resources to the sets that need them, plus also restrict access to them accordingly.

> [@spuder](#):
>
> Splitting indexes makes data more contained, but comes at a higher administrative cost. (Having to run multiple curators per day)

Who cares? It's automated 😉

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 11:33pm UTC](https://discuss.elastic.co/t/should-you-split-indexes-by-category/36424/3 "2017-07-05T23:33:27Z")

</div>

Closed on July 5, 2017, 11:33pm UTC