On Monday, March 09, 2015 at 20:29 CET,
Andy Nemzek <[email protected]> wrote:
> We've been using logstash for several months now and it creates a new
> index each day, so I imagine there are over 100 indexes at this point.
Why create daily indexes if you only have a few hundred entries in each?
There's a constant overhead for each shard so you don't want more
indexes than you need. Seems like you'd be fine with montly indexes,
and then your snapshot problems would disappear too.
> Elasticsearch is running on a single machine...I haven't done anything
> with shards, so the defaults must be in use. Haven't optimized old
> indexes. We're pretty much just running ELK out of the box. When you
> mention 'optimizing indexes', does this process combine indexes?
No, but it can combine segments in a Lucene index (that make up
Elasticsearch indexes), and segments are what's being backed up.
So the more segments you have the the longer time snapshots are
going to take.
> Do you know if these performance problems are typical when
> using ELK out of the box?
100 indexes on a single box should be okay but it depends on
the size of the JVM heap.
--
Magnus Bäck | Software Engineer, Development Tools
[email protected] | Sony Mobile Communications
--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/20150311071150.GB5729%40seldlx20533.corpusers.net.
For more options, visit https://groups.google.com/d/optout.
