Best practice for index configuration


Hello everybody,
I come back with a new question about how to configure indexs into Graylog?
The thing is that I know that I want set the retention by size, cause I have for the moment one elasticsearch node with 200Go usable.
But, I don’t know if it’s better to have few indexs with large size or lot of index with small size. I started with 5Go per index with 40 indexs. But maybe it’s better to have 200 indexs of 1Go?
Could you explain to me the best practice for a better optimisation?

Also, I have the same question about the number of shards, I kept the default value:4. Does it have any impact on the performance even on a single node?



(Jochen) #2

Please refer to the following documents:


Thanks Jochen,

I’ll dive into those documentations. I thought there were general classical rules to apply.