Time based rollover vs Time based routing

Elastic Stack Elasticsearch
1

Hi everyone

I wonder what's better in my use case. A single large index, a time based rollover (monthly maybe) or a time based (monthly) shard routing?

The case 10million documents each month (daily ingestion). Some of them are updates but mostly indexing new ones.
I have to keep all those documents, no daily cleanup. Also each document have an inmutable timestamp field.

Also, what about merging it daily? The ingestion is done in a daily batch, all at once.

I mostly run aggregations (like 10 fields/conditions) and few searchs.

2

You should not use a single big index, or any sort of single index-time based shard routing.

You should use ILM.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.