Best practice for index configuration

Graylog Central (peer support)
1

Hello everybody,
I come back with a new question about how to configure indexs into Graylog?
The thing is that I know that I want set the retention by size, cause I have for the moment one elasticsearch node with 200Go usable.
But, I don’t know if it’s better to have few indexs with large size or lot of index with small size. I started with 5Go per index with 40 indexs. But maybe it’s better to have 200 indexs of 1Go?
Could you explain to me the best practice for a better optimisation?

Also, I have the same question about the number of shards, I kept the default value:4. Does it have any impact on the performance even on a single node?

Thanks!

Arnaud

2

Please refer to the following documents:

3

Thanks Jochen,

I’ll dive into those documentations. I thought there were general classical rules to apply.

4


It is full with useful information about this topic.

1 Like