Hi Jörg, Thank you for pointing me to this article. I needed to read it twice, but I think I understand it now.
I believe shard overallocating works for use-cases where you want to store & search 'users' or 'products'. Such data allows you to divide all documents into groups to be stored in different shards using routing. All shards get indexed & searched. But how does this work for logstash indices? I could create 1 index with 365 shards (if I want 1 year of retention) and use alias routing (alias per date with routing to a shard) to index into a different shard every day, but after 1 year I need to purge a shard. And purging a shard is not easy. It would require a delete of every document in the shard. Or am I missing something? Regards, Renzp Op donderdag 17 april 2014 16:15:43 UTC+2 schreef Jörg Prante: > > "17 new indices every day" - whew. Why don't you use shard overallocating? > > > https://groups.google.com/forum/#!msg/elasticsearch/49q-_AgQCp8/MRol0t9asEcJ > > Jörg > > -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/88a6f992-400b-4fb5-80e5-7b024b17ffd6%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
