I am planning to use elasticsearch (ES) for storing event logs. Per day, the application should store nearly 3000+ events and size will be around 30-50K. I need to take some statistics monthly, half yearly, yearly.... also year old data can be ignored sometimes but data should be retained for many years I want to know the best practices in this scenario 1. Is it a good idea to create shards based on size/period or create one shard with multiple alices based on filter condition? 2. Does ES merges the search results coming from multiple shards? If yes, how fast or better it is compared to lucene's ranking based on Vector space model?
-- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/cafc1166-549e-41b2-bf64-e8966f2e610a%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
