Why Log Data Retention Windows Fail
If you’re using Elasticsearch as part of an ELK stack solution for log analytics, you’ll need to manage the size of your indexed log data to achieve the best performance. Elasticsearch indices have no limit to their size, but a larger index takes longer to query and is more costly to store. Performance degradation is often observed with large Elastic indices and queries on large indices can even crash Elasticsearch when they use up all of the available heap memory on the node.