There are 3 things to consider when laying out index values:
1: In/Visibility (RBA) : who should/not see what data? Map out the roles that need to see the data and the roles that should not be able to see the data. Access to data is only reliably enforced at the index level.
2: Retention : how long do you need to keep each kind of data? Bucket rolling/deletion is implemented at the index level.
3: Value/Risk : how important is the retention goal for this data? If you have very important data and not-so-important data in the same index and you must keep it for a year and you have enough space to hold about 15 months, but somebody makes a mistake and turns on debug on the not-so-important data stream and it accidentally sends in 1 year's worth of data in a day, before it is discovered, you now have prematurely aged out most, if not all, of your important data, and it is GONE.
If you get these 3 right, everything else will be just fine.
... View more