Elasticsearch: inverted index for full-text search. Index per day for easy retention (delete old indices). Shards distribute load.
Hot-warm architecture: recent indices on fast SSDs, older on HDDs. Frozen tier for archival. Index lifecycle management automates transitions. Compression trades CPU for storage. Consider cheaper alternatives (Loki, ClickHouse) for high volume.