In most cases multiple indexes are better:
- Searching against smaller dataset is faster
- You are less limited in mapping structure. If you need to change it for new data, you can keep old data without reindexing and just put new mapping for new index
- It’s more scalable and flexible. You can keep old indexes on a different hard drive or a different machine.
- You still can search against multiple indexes, if required.
- The overhead for index is small. If you have lots of documents per index, documents take much more space than index metadata. If not, you can take a smaller time period to split your log indexes