Using the same index for a year

[mertkaant (Mert Kağan)]

Hello, elastic community,

I have a new index and I'm writing small data daily to this index. I want to achieve lifecycle management for this index and about that, I thought since this is a really small index can I configure lifecycle management like this?

• Keep the index in hot phase for a year then rollover to a new index and move the old index to the cold phase.

If it was a big index I would go with recommended defaults which are "rollover if the index is 30 days old or any primary shard's size > 50GB"

Notes:

• Even if I use the same index for writing/reading for a year, the index size won't pass 100GB.
• This index will be in production and it is a highly used environment

My questions are:

1. Can I use the same index for a year with keeping that index in the hot phase? Is it okay for cluster/index health?
2. Is this gonna trouble me in the future? about performance issues?
3. Since there won't be any date implementation on the index name, am I going to search fastly on this index?

[warkolm (Mark Walkom)]

Depends what you mean by small, but yes this is a totally reasonable approach for low volume data.

[mertkaant (Mert Kağan)]

The data will be around 50KB-10MB for a day. I'll set up a lifecycle policy with 1-year hot phase scenario. Thanks for the reply!