Reputation: 512
Imagine that I have so many around millions of nginx, apache,..types of logs. I want to send them to elasticsearch day to day. I want to ask that. How should I chose the count of nodes and documents. I mean should i create an index for every day or create an index for just the type of log and create documents for days ? and What about count of data nodes. Can someone help thanks a lot
Upvotes: 0
Views: 218
Reputation: 32376
This are many design approaches which you can choose, although its difficult to cover the pros/cons of each approach, I can in short tell that its very common to have the time based indices for log analysis. And shards and replicas depends on your search traffic, shard size and number of documents in your index.
You need to do some sort of capacity planning and benchmarking to identify what best fits according to your data-set and use-case.
Upvotes: 1