What is the advantage of multiple index in elasticsearch?

0
votes

Example for this is Logstash format. They formatted their index in elasticsearch with [logstash-]YYYY.MM.DD, where a new index will be used each day. The elasticsearch itself will be used by Kibana. Is there any reason why it's being done? What is the advantage?

1
elasticsearchlogstashkibana

1 Answers

5
votes

Advantages that come to mind:

  1. If you're looking for Tuesday's data, you can just look in Tuesday's index.
  2. You can delete old data more easily.
  3. If you want to modify the mappings, you can update the template and the changes will take effect the next day. It's your choice if you want to reindex the old data or not.