You could change the index data format. One word of caution here though; the last time I saw this done it caused huge problems with locking on ingest against people running queries on the current day’s data and tended to knock recent relevant indexes out of disk cache at the OS level. It might look like it will help a bit for ingest initially, but with load on the end user side, it’s probably going to kill your disks at any reasonable scale.
Simon > On 14 Jul 2017, at 10:31, Ali Nazemian <alinazem...@gmail.com> wrote: > > Hi, > > I am investigating different tuning aspects, and I was wondering how I can > change the policy of Elasticsearch indexing. Currently, as a default > behaviour, events are stored in separate indices hourly. How can I change > this behaviour? Is this a hard-coded design or I can change it through > configurations? > > Cheers, > Ali
