two simple and quite basic questions regarding search performance in elastichsearch

[stemanit]

Dear community I have two simple and quite basic questions regarding search performance in elastichsearch in general:
If I am interested of doing searches in the documents / indicies in a time window of max. the latest 24 hours, does it have an impact on search performance if I have also stored data on the disk older than that, that I do nothing with?
Meaning: If I only search hot data (maxx 24 hours) does it matter in terms of search performance if I have 30 days of 300GB each day staying on the disks too and this amount perhpas is still growing?

Background: I have search performance issues. If I theoretically cut the amount of data from 60 days to 24h would it make a noticable, positive impact on search performance? (under the condition that I only search the latest 24 hours)

Thank you very much for any insight in this!
Kind regards

[stemanit]

I am using ES Version 8.14.3.
These are syslog documents stored in a daily data stream.
cheers

[reyesj2]

What does your deployment consist of ? Is it a standalone? Is it distributed? Do you have multiple searchnodes? What hardware do you have for the server(s).

[stemanit]

Hi Jorge, at my company we are using a standalone architecture right now. I was not my choice. I inherited the job and the instances. so, no extra searchnodes and yes, the guy before me bought hardware with spinning disks :-( (virtual machines on ESX). Now I am trying to do my best, to make performance better. Would two extra searchnodes help? ...one extra would probably cause some problems because of the split brain topic in elasticsearch I very much presume.
So, I am grateful for any thoughts / insights you can give me!
Thanks and kind regards.

[stemanit]

...anyone any opinion in this matter?

Thanks and kind regards!

[reyesj2]

If you're looking for performance then your best bet is a distributed deployment where you get more flexibility.

If you add a searchnode or two to your standalone, you can setup ilm and data tiers https://docs.securityonion.net/en/2.4/elasticsearch.html#elasticsearch-node-roles