What is the best practice for organizing indexes for multiple environments of an application such as dev, QA, and prod?

[tjj9309]

What is the best practice for organizing indexes for multiple environments of an application such as dev/qa/prod? Is it best to separate them all out into their own index or use a single index?

Thank you

[woodcock]

Generally it is FAR easier to join together prior to launching than it is to separate afterwards when it becomes necessary for some unforeseen reason so I always suggest we separate on an index-level and also use tags or eventtypes to provide automatic delineation when more than 1 index is used in a combined search.

[the_wolverine · Accepted solution]

The decision can be determined by answering multiple questions:

1. Is the data going to be queried simultaneously? That is, will you ever need to search for dev/prod at the same time (in the same query)? If no, you can separate the data by env.
2. Are different sets of users going to require access to different indexes? If so, yes, you should separate the data into separate indexes.
3. Are you managing a high volume of data? Then yes, separating into separate indexes may provide you with better search performance particularly if you are only searching one env at a time.

Ultimately, it is up to you. The data (most likely) will have inherent features that separate it, either by host, source or sourcetype so, while a separate index is not required, consider the other benefits of separating your data.