Depends on the version of elasticsearch you’re running and the use-case. If you’re running a single index with a well-defined schema, I think elasticsearch wor

Depends on the version of elasticsearch you’re running and the use-case. If you’re running a single index with a well-defined schema, I think elasticsearch works very well. If you need many indices and can’t have a defined scheme, then it can be tough. I work on a team at Target that provides a log aggregation product and we’re finding that a single index with a well-defined schema used to troubleshoot applications via logs is very easy to manage and scale. We support some legacy patterns like “index per application” that are a pain in the ass to manage. Just to provide some context, we manage about 40 clusters that range from a few data nodes to about 160 data nodes with the majority falling in the 16-60 node ballpark. We don’t have a problem with data loss due to elasticsearch, generally speaking.