# Time based Log Data - Index Modeling - Log Data Multiple Applications

**URL:** <https://discuss.elastic.co/t/time-based-log-data-index-modeling-log-data-multiple-applications/150584>\
**Category:** Elasticsearch\
**Created:** [October 1, 2018, 3:34pm UTC](https://discuss.elastic.co/t/time-based-log-data-index-modeling-log-data-multiple-applications/150584 "2018-10-01T15:34:36Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![ESNovice](https://avatars.discourse-cdn.com/v4/letter/e/8dc957/32.png) [@ESNovice](https://discuss.elastic.co/u/ESNovice)\
**Post date:** [October 1, 2018, 3:34pm UTC](https://discuss.elastic.co/t/time-based-log-data-index-modeling-log-data-multiple-applications/150584/1 "2018-10-01T15:34:36Z")

</div>

Will apprecaite if someone can please help in structuring data properly on ES .

My log data from 10 different applications (Ap1 , Ap2....A10) are loaded in ES. Currently index is per day. Logstash\_2018.10.01 houses all log data for all 10 applications that was generated on 2018.10.01. The data streams in with minimal lag.

My window for data retention is 7 days. Access Pattern is mostly the data that came in last few minutes /hours is reall the hottest. Access for older data especailly OTHER than today and yesterday is rare but possible. In general will access today data (80%) of time. Today and Yesterday data (15%) . Rest 5% where data from last 7 days might be accessed.

From this data - Questions are normally always asked in context of an app. Typical example willl for App1 show me any error or exception that happened today or last few mins/hours, as this being log analytics application.

**Kibana (95%)** will be primary query/visualization engine,

Will appreciate if I can get some pointers to design my system better than current one index per day encompassing all App data. I read multiple things like alias , routing , alias but was not sure how . Being a novice any advice will be greatly appreciated

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 29, 2018, 3:34pm UTC](https://discuss.elastic.co/t/time-based-log-data-index-modeling-log-data-multiple-applications/150584/2 "2018-10-29T15:34:39Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.