I am currently designing index architecture and index patterns. Is it advisable to write on an index for 30 days? I am doing a namespace level indexing hence the traffic in the namespace is very fewer Elasticsearch documents suggests having shard's size of 20-50GB. It would take around 30 days for the index to reach this mark. Is this advisable?

CodePudding user response：

If you have time-based data, the official recommendation is to keep writing your documents to time-based indexes up to a certain size (between 10GB and 50GB) and then have Index Lifecycle Management roll over to new a new index once the index reaches that size.

The new way of dealing with time series data is to leverage data streams which handle all the nitty gritty details of creating new indices, rolling over to them and provide a high-level read access to all the underlying historical indexes.