# Best practice for index configuration

**URL:** https://community.graylog.org/t/best-practice-for-index-configuration/984
**Category:** Graylog Central (peer support)
**Created:** [April 29, 2017, 5:11pm UTC](https://community.graylog.org/t/best-practice-for-index-configuration/984 "2017-04-29T17:11:02Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![arnaud](https://avatars.discourse-cdn.com/v4/letter/a/e8c25b/32.png) [@arnaud](https://community.graylog.org/u/arnaud)
#### Post date: [April 29, 2017, 5:11pm UTC](https://community.graylog.org/t/best-practice-for-index-configuration/984/1 "2017-04-29T17:11:02Z")

</div>

Hello everybody,  
I come back with a new question about how to configure indexs into Graylog?  
The thing is that I know that I want set the retention by size, cause I have for the moment one elasticsearch node with 200Go usable.  
But, I don’t know if it’s better to have few indexs with large size or lot of index with small size. I started with 5Go per index with 40 indexs. But maybe it’s better to have 200 indexs of 1Go?  
Could you explain to me the best practice for a better optimisation?

Also, I have the same question about the number of shards, I kept the default value:4. Does it have any impact on the performance even on a single node?

Thanks!

Arnaud

---

<div class="post-metadata">

### Author: ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)
#### Post date: [May 1, 2017, 10:27am UTC](https://community.graylog.org/t/best-practice-for-index-configuration/984/2 "2017-05-01T10:27:28Z")

</div>

Please refer to the following documents:

- [https://www.elastic.co/guide/en/elasticsearch/reference/2.4/\_basic\_concepts.html](https://www.elastic.co/guide/en/elasticsearch/reference/2.4/_basic_concepts.html)
- [https://www.elastic.co/guide/en/elasticsearch/guide/2.x/capacity-planning.html](https://www.elastic.co/guide/en/elasticsearch/guide/2.x/capacity-planning.html)
- [https://qbox.io/blog/optimizing-elasticsearch-how-many-shards-per-index](https://qbox.io/blog/optimizing-elasticsearch-how-many-shards-per-index)

---

<div class="post-metadata">

### Author: ![arnaud](https://avatars.discourse-cdn.com/v4/letter/a/e8c25b/32.png) [@arnaud](https://community.graylog.org/u/arnaud)
#### Post date: [May 2, 2017, 2:05pm UTC](https://community.graylog.org/t/best-practice-for-index-configuration/984/3 "2017-05-02T14:05:11Z")

</div>

Thanks Jochen,

I’ll dive into those documentations. I thought there were general classical rules to apply.

---

<div class="post-metadata">

### Author: ![macko003](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/macko003/32/3175_2.png) [@macko003](https://community.graylog.org/u/macko003)
#### Post date: [January 29, 2019, 12:48pm UTC](https://community.graylog.org/t/best-practice-for-index-configuration/984/4 "2019-01-29T12:48:35Z")

</div>

> **[How many shards should I have in my Elasticsearch cluster?
	  	 | Elastic](https://www.elastic.co/de/blog/how-many-shards-should-i-have-in-my-elasticsearch-cluster)**
>
> Elasticsearch is a very versatile platform, that supports a variety of use cases, and provides great flexibility around data organisation and replication strategies. This flexibility can however somet...

  
It is full with useful information about this topic.
