Elastic search, multiple indexes vs one index and types for different data sets? Elastic search, multiple indexes vs one index and types for different data sets? elasticsearch elasticsearch

Elastic search, multiple indexes vs one index and types for different data sets?


There are different implications to both approaches.

Assuming you are using Elasticsearch's default settings, having 1 index for each model will significantly increase the number of your shards as 1 index will use 5 shards, 5 data models will use 25 shards; while having 5 object types in 1 index is still going to use 5 shards.

Implications for having each data model as index:

  • Efficient and fast to search within index, as amount of data should be smaller in each shard since it is distributed to different indices.
  • Searching a combination of data models from 2 or more indices is going to generate overhead, because the query will have to be sent to more shards across indices, compiled and sent back to the user.
  • Not recommended if your data set is small since you will incur more storage with each additional shard being created and the performance gain is marginal.
  • Recommended if your data set is big and your queries are taking a long time to process, since dedicated shards are storing your specific data and it will be easier for Elasticsearch to process.

Implications for having each data model as an object type within an index:

  • More data will be stored within the 5 shards of an index, which means there is lesser overhead issues when you query across different data models but your shard size will be significantly bigger.
  • More data within the shards is going to take a longer time for Elasticsearch to search through since there are more documents to filter.
  • Not recommended if you know you are going through 1 terabytes of data and you are not distributing your data across different indices or multiple shards in your Elasticsearch mapping.
  • Recommended for small data sets, because you will not waste storage space for marginal performance gain since each shard take up space in your hardware.

If you are asking what is too much data vs small data? Typically it depends on the processor speed and the RAM of your hardware, the amount of data you store within each variable in your mapping for Elasticsearch and your query requirements; using many facets in your queries is going to slow down your response time significantly. There is no straightforward answer to this and you will have to benchmark according to your needs.


Although Jonathan's answer was correct at the time, the world has moved on and it now seems that the people behind ElasticSearch have a long term plan to drop support for multiple types:

Where we want to get to: We want to remove the concept of types from Elasticsearch, while still supporting parent/child.

So for new projects, using only a single type per index will make the eventual upgrade to ElasticSearch 6.x be easier.


Jonathan's answer is great. I would just add few other points to consider:

  • number of shards can be customized per solution you select. You may have one index with 15 primary shards, or split it to 3 indexes for 5 shards - performance perspective won't change (assuming data are distributed equally)
  • think about data usage. Ie. if you use kibana to visualize, it's easier to include/exclude particular index(es), but types has to be filtered in dashboard
  • data retention: for application log/metric data, use different indexes if you require different retention period