Thanks for the article! We have a tiny hosted ELK cluster for our app logging, but we don't have much expertise in good cluster design. We recently implemented monthly rolling indices, and currently have a single 'archive' index for the old data (from the past two years) sharded into 25GB chunks. Would it make sense from a query performance perspective to add extra replicas to the 'archive' shards, to help spread the load between the nodes? Thanks for any thoughts!
But currently we have concluded that it is not worth the added complexity. But that might change again if/when we learn more or get new requirements.
We do change the number of replicas for recent data vs old data. We actually have a 4 tiered approach to how many replicas we use.