# Strategy for index over a rolling window of realtime data **URL:** \ **Category:** Elasticsearch\ **Created:** [September 2, 2010, 7:07pm UTC](https://discuss.elastic.co/t/strategy-for-index-over-a-rolling-window-of-realtime-data/3297 "2010-09-02T19:07:23Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![colinsurprenant](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/colinsurprenant/32/14776_2.png) [@colinsurprenant](https://discuss.elastic.co/u/colinsurprenant)\ **Post date:** [September 2, 2010, 7:07pm UTC](https://discuss.elastic.co/t/strategy-for-index-over-a-rolling-window-of-realtime-data/3297/1 "2010-09-02T19:07:23Z")
Hi, I need to keep an index over a 4-5 weeks rolling window of realtime data. The granularity could be week or day. My question is, performance wise, is it a better idea to deal with 4 weekly indices of 30 daily indices? Would my number of current and planned nodes impact this choice? What would scale better in terms of increased data volume and addition of new nodes? I am planning on using an alias which will associate with the past 4 weekly indices or the past 30 daily indices. Thanks, Colin ---
**Author:** ![kimchy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kimchy/32/44952_2.png) [@kimchy](https://discuss.elastic.co/u/kimchy)\ **Post date:** [September 2, 2010, 8:05pm UTC](https://discuss.elastic.co/t/strategy-for-index-over-a-rolling-window-of-realtime-data/3297/2 "2010-09-02T20:05:53Z")
Hi, Good question. Let me get back first to how search works. At the end, a search is executed (in parallel) on index shards, the results are reduced and sent back to the client. Its all about index shards, not really about indices. As an example, a search against a single index with 7 shards is the same as executing search against 7 indices each with 1 shard (ignoring replicas here, as search is round robin between shard and its replicas). So, the main question is how many shards do you expect to need for one week. If you want to use one day resolution or 7 day resolution is your decision. For example, if you think you will need 7 shards for a single index in an index per week scenario, you can as easily create a single index each day with 1 shard (replicas are again out of the question here, its an agnostic decision). The benefit of either 1 week or 1 day resolution is the ability to scale based on load. For example, if you find out that there is more load than expected, then the next index you create can hold more shards. In the one week scenario, you have more resolution to add shards, for example, you can decide to go from 7 shards to 10 shards. If you have one day resolution, then going up from 1 shard to 2 shards means going up to 14 shards per week. -shay.banon On Thu, Sep 2, 2010 at 10:07 PM, Colin Surprenant \< [colin.surprenant@gmail.com](mailto:colin.surprenant@gmail.com)\> wrote: > Hi, > > I need to keep an index over a 4-5 weeks rolling window of realtime > data. The granularity could be week or day. > > My question is, performance wise, is it a better idea to deal with 4 > weekly indices of 30 daily indices? Would my number of current and > planned nodes impact this choice? What would scale better in terms of > increased data volume and addition of new nodes? > > I am planning on using an alias which will associate with the past 4 > weekly indices or the past 30 daily indices. > > Thanks, > Colin ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 4:19am UTC](https://discuss.elastic.co/t/strategy-for-index-over-a-rolling-window-of-realtime-data/3297/3 "2017-07-06T04:19:47Z")
Closed on July 6, 2017, 4:19am UTC