---
title: Partition data into child streams
description: For wired streams, the wired streams endpoints act as the entry point for all your log data. Once you've sent your data to a wired streams endpoint, open...
url: https://www.elastic.co/elastic/docs-builder/docs/3016/solutions/observability/streams/management/partitioning
products:
  - Elastic Cloud Enterprise
  - Elastic Cloud Hosted
  - Elastic Cloud Serverless
  - Elastic Cloud on Kubernetes
  - Elastic Observability
  - Elastic Stack
  - Elasticsearch
  - Kibana
applies_to:
  - Elastic Cloud Serverless: Preview
  - Elastic Stack: Preview since 9.2
---

# Partition data into child streams
<note>
  The **Partitioning** tab and the ability to route data into child streams is only available on [wired streams](https://www.elastic.co/elastic/docs-builder/docs/3016/solutions/observability/streams/wired-streams).
</note>

For [wired streams](https://www.elastic.co/elastic/docs-builder/docs/3016/solutions/observability/streams/wired-streams), the wired streams endpoints act as the entry point for all your log data.
Once you've sent your data to a wired streams endpoint, open the stream and use the **Partitioning** tab to organize and route the data into meaningful child streams. For example, you can partition your logs into child streams their source or type:
- Route application logs to a `logs.otel.myapp` child stream.
- Route system logs to a `logs.otel.system` child stream.

For more on when to partition your data and how granular your partitioning should be, refer to [Partitioning recommendations](#streams-partitioning-recommendations).
Create partitions using the following options:
- [**Manual configuration**](#streams-manual-partitioning): Use fields and attributes from your data to define how it's routed to child streams.
- [**AI suggestions**](#streams-AI-partitioning): Let Streams analyze your data and suggest partitions, which you can review and accept or reject.


## Partitioning recommendations

Partitioning helps you manage your data when you have multiple systems sending logs to a single parent stream.
Focus on logical groupings for data such as by team or overarching technology. For example, partition web server logs in one stream and custom application logs in another.
Don't partition by fields with high cardinality. Even partitioning by common fields like `service.name` can create too many partitions to manage effectively.
As a general rule, aim for tens of partitions, not hundreds. Each partition comes with a cost, as it creates a data stream in Elasticsearch under the hood. You can have many of them, but not an unlimited amount.

### When you *need* to partition

You only *need* a partition when you want a subset of your data to follow a different lifecycle than the rest.
For example, suppose you have a noisy firewall and a quiet custom application sending logs to the same stream. You don't need to retain the firewall logs for as long and they take up disk space. In this case, you can partition the stream and assign a different [ILM policy or retention setting](https://www.elastic.co/elastic/docs-builder/docs/3016/solutions/observability/streams/management/retention) to each child stream:
```bash
logs
- logs.otel.firewall [7d]
- logs.otel.custom-app [30d]
```


## Create partitions manually

To manually configure when to send data to child streams:
1. Select **Create partition manually**.
2. From the **Data preview**, filter data based on fields or attributes by hovering over the field and selecting:

- `plus_in_circle` to add routing conditions that equal the field.
- `minus_in_circle`to add routing conditions that do not equal the field.

1. Under **Stream name**, give your stream a name based on the condition.
2. Select **Save** to create the child stream.

Under **Condition**, you can also set the field you want to use for the condition, the comparator, and the value of the field. Turning on the **Syntax editor** lets you manually enter the conditions in a YAML editor. For more on conditions, refer to [Streamlang conditions](/elastic/docs-builder/docs/3016/solutions/observability/streams/management/streamlang#streams-streamlang-conditions).

## Create partitions using AI suggestions

<note>
  This feature requires a [Generative AI connector](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3016/reference/kibana/connectors-kibana/gen-ai-connectors).
</note>

To use AI suggestions to send data to child streams:
1. Select **Suggest partitions with AI**. Streams uses AI to look at your data and give you suggestions for grouping your data.
2. Either **Accept** or **Reject** the AI suggestions. After selecting **Accept**, you'll see the suggested **Stream name** and **Condition**.
3. Select **Create stream**.


## Next steps

After partitioning your wired streams:
- [Extract fields](https://www.elastic.co/elastic/docs-builder/docs/3016/solutions/observability/streams/management/extract) using the **Processing** tab to filter and analyze your data effectively.
- [Map fields](https://www.elastic.co/elastic/docs-builder/docs/3016/solutions/observability/streams/management/schema) using the **Schema** tab to make fields easier to query.