Best index/document structure for ElasticSearch/OpenSearch

Question

I'm new to ElasticSearch\/OpenSearch and I'm trying to figure out the best way to organize indices and document structure for my use case. I would like to render some stats from my application on a dashboard, so I plan to send some important events from my application to ElasticSearch\/OpenSearch directly.

{
  "type": "api.request",
  "method": "{method-name}",
  "timestamp": "{timestamp}"
}

Answer 1

This schema should work ok in general, and you can start with putting all events in one index. Import or create some fake data, index it and try to get the results you need with ES aggregations<\/a> . As the dataset grows, you'll see the bottlenecks and resolve them.