# Single index or multiple index **URL:** \ **Category:** Elasticsearch\ **Created:** [August 21, 2021, 11:04am UTC](https://discuss.elastic.co/t/single-index-or-multiple-index/282139 "2021-08-21T11:04:31Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![selin](https://avatars.discourse-cdn.com/v4/letter/s/9de053/32.png) [@selin](https://discuss.elastic.co/u/selin)\ **Post date:** [August 21, 2021, 11:04am UTC](https://discuss.elastic.co/t/single-index-or-multiple-index/282139/1 "2021-08-21T11:04:31Z")
My environment architecture is I have 15 server. The details as below Group 1 (Standalone) - server 1 (2 app) - server 2 3 app) - server 3 (2 app) - server 4 (3 app) Group 2 (master and slave) - server 5 master (2 app) - server 6 slave (2 app) Group 3 (master and 2 slave) - server 7 master (3 app) - server 8 slave (3 app) - server 9 slave (3 app) Group 4 (1 master 5 slave) - server 10 master (1 app) - server 11 slave (1 app) - server 12 slave (1 app) - server 13 slave (1 app) - server 14 slave (1 app) - server 15 slave (1 app) Each application have 15 -20 logs What is the best way in creating the index in logstash? Is below better for index pattern app\_name-log\_name-YYMMDD Later i want to visual in Kibana in below form table panel form consist of time, message based on respective log name The below is data for a sinngle log. other log have simillar pattern but different data. i want to dispaly only for single log show single table ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/7/0757b9ca17ac69d41d96875de5076ccf17efcdc3.jpeg) ---
**Author:** ![elasticforme](https://avatars.discourse-cdn.com/v4/letter/e/f05b48/32.png) [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Post date:** [August 21, 2021, 6:38pm UTC](https://discuss.elastic.co/t/single-index-or-multiple-index/282139/2 "2021-08-21T18:38:14Z")
this will explode in number of index. too many if you do it daily. you have to find out how large each index is per application if they are small then you might want to do it monthly index per application if you want to seperate by application if you want to do it by server then you have to check that. basically it is bad idea to have too many small index. ---
**Author:** ![selin](https://avatars.discourse-cdn.com/v4/letter/s/9de053/32.png) [@selin](https://discuss.elastic.co/u/selin)\ **Post date:** [August 22, 2021, 2:26am UTC](https://discuss.elastic.co/t/single-index-or-multiple-index/282139/3 "2021-08-22T02:26:22Z")
hi creating multiple index should be faster right in performance than creating single index? When i want search for specific data in 1 logs. If single index, in that index will have alot of logs but i jsut want to search for a particular logs. wont it be slow? ---
**Author:** ![elasticforme](https://avatars.discourse-cdn.com/v4/letter/e/f05b48/32.png) [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Post date:** [August 23, 2021, 2:09pm UTC](https://discuss.elastic.co/t/single-index-or-multiple-index/282139/4 "2021-08-23T14:09:41Z")
yes it does. I thought along the same logic when I was first learning elk. but as you will grow. too many index will slow down everything as cluster have to keep stat of everything. and there is some hard limit of how many shard each server can have. once you reach that limit you will have many other problem. once I started following rule that most used index will be max 10gig, less use index I use 30gig or more, since then I have very less problem and speed is not an issue so far. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 20, 2021, 2:10pm UTC](https://discuss.elastic.co/t/single-index-or-multiple-index/282139/5 "2021-09-20T14:10:38Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.