Re-indexing uses CPU, memory, and disk bandwidth. If re-indexing of event data partition is performed during peak hours, it might take more time than expected or might add load on the existing jobs. Hence, we recommend that you re-index during a scheduled maintenance time or during off-peak hours.
If there are many event data partitions to re-index, to optimize the time taken to re-index, select the date range for event data partitions that contain events that must be searchable and reportable for priority operations. You can re-index the rest of the event data partitions as per your requirement.
(Conditional) If event visualization is enabled in the Sentinel, before scheduling re-indexing, you must ensure that the OpenSearch is left intact. See Mapping Conflict Warning in the OpenSearch dashboard Search for more information.