we are currently planning a cluster which takes about 1TB/year worth of data. When using a standard shard size of 5 this would mean that the shards are 250GB. As far as I know shards should only be around 50-70GB at max. So we have 2 Options:
- Increase the shard size to 20 or more.
- Create a new index every month or so.
How can l configure logstash so that it uses the right index when a new index is created? Zero downtime is required, thats why using one index seems way easier.
What creates the new index, where is it configured.
I can access all indices at the same time with an alias right?