What's the best for Eleasticsearch ? (managment of index)



First of all, i'm sorry if my english is not totaly correct.

I have a question on Elasticsearch about the management of index.

My question : For Elasticsearch, it's better : manage a lot index with small size or manage few index with bigger size ?

At the moment, we using ELK for centralize servers logs.

every day an index is created for each application/service.

Exemple :


With that, I have many more than 1000 index in my ELK.

Would not it be better for Eleasticsearch to manage everything in a single index for the day ?


Thank you for your help :slight_smile:


(Christian Dahlqvist) #2

Having a lot of very small shards and indices can be very inefficient, so consolidating into fewer larger indices will most likely allow to to handle more data in the cluster.


Thank you very much, this helped me to understand how to handle shards and indexes.


(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.