Hi, I'm new to the elasticsearch scene and have quite a lot of questions.
First of all, my use case at the moment is pretty simple: when a user performs a "registration" action on my site, I want to add a document logging this occurrence so that I can track and visualize in Kibana when and how many users are registering.
After doing a lot of reading, I have the mile-high view of wanting time-based indices. A daily or weekly index seems appropriate, so that way on slow days it'll be OK, and on days where potentially many users register it won't blow up the index.
A common approach seems to be to set up an index template and just let the index be created when you insert (i.e. logs_* template where the * is today's date), but another one is to create the indices yourself (I've come to assume) and set up an alias for "today's index" and another index for the past 3 month for searching.
Unfortunately, I'm limited to AWS ES, so I can't use the fancy new rollover api it seems. Which was a bummer since the blog has a nice post about it.
So, in summary my main questions are:
For my use case, would it be better to rely on auto-generated indices, or try to have more control with aliases?
These documents won't be modified after insert, so are there any optimizations I can take?
How can I manage old indices? Since once the day/week ends, I no longer need to devote any resources to writing to the index anymore, just reading for the occasional search.
If I do go with aliases, since I don't have the rollover api, what's the best way to make sure my aliases are kept up to date and my old indices are removed from that "last 3 months" window?