I wonder what's better in my use case. A single large index, a time based rollover (monthly maybe) or a time based (monthly) shard routing?
The case 10million documents each month (daily ingestion). Some of them are updates but mostly indexing new ones.
I have to keep all those documents, no daily cleanup. Also each document have an inmutable timestamp field.
Also, what about merging it daily? The ingestion is done in a daily batch, all at once.
I mostly run aggregations (like 10 fields/conditions) and few searchs.