# Alert: Large shard size

**URL:** <https://discuss.elastic.co/t/alert-large-shard-size/316184>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-monitoring\
**Created:** [October 10, 2022, 7:23am UTC](https://discuss.elastic.co/t/alert-large-shard-size/316184 "2022-10-10T07:23:06Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Michele\_De\_Benedet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/michele_de_benedet/32/100766_2.png) [@Michele\_De\_Benedet](https://discuss.elastic.co/u/Michele_De_Benedet)\
**Post date:** [October 10, 2022, 7:23am UTC](https://discuss.elastic.co/t/alert-large-shard-size/316184/1 "2022-10-10T07:23:06Z")

</div>

Hi,

I am using Logstash to feed an index. Current index size is 60GB and I'm expecting it to grow to at most 100GB, so I set it to use 6 shards. Elasticsearch is ran on a single node.

The status of the index in Kibana is as follows:  
**Status Health** Green  
**Alerts** 1  
**Total** 60.9 GB  
**Primaries** 60.9 GB  
**Documents** 63.5m  
**Total shards** 6  
**Unassigned shards** 0

And the red alert says:  
**The following index: [index\_name] has a large shard size of: 65.35GB at October 10, 2022 9:15 AM CEST**

But how can it be? I am using 6 shards, each having a 10GB size. How can I fix it?

Logstash output configuration:

```auto
output {
  # stdout { }
  elasticsearch {
    hosts => ...
    user => ...
    password => ...
    index => "index_name"
    doc_as_upsert => true
    action => "update"
    document_id => ...
    template => "/usr/share/logstash/template/index_name.json"
    template_name => "index_name"
  }
}

```

Template configuration:

```auto
{
  "index_patterns": ["index_name"],
  "settings": {
    "index": {
      "number_of_shards": 6,
      "number_of_replicas": 0
    }
  }
}

```

Get shards

```auto
index_name 4 p STARTED 10587624 10.4gb * elasticsearch
index_name 1 p STARTED 10585296 9.9gb * elasticsearch
index_name 2 p STARTED 10585089 9.9gb * elasticsearch
index_name 5 p STARTED 10584801 9.9gb * elasticsearch
index_name 3 p STARTED 10588147 10.1gb * elasticsearch
index_name 0 p STARTED 10590486 10.4gb * elasticsearch

```

Shard status (GET \_cluster/health/?level=shards):

```auto
  "index_name" : {
      "status" : "green",
      "number_of_shards" : 6,
      "number_of_replicas" : 0,
      "active_primary_shards" : 6,
      "active_shards" : 6,
      "relocating_shards" : 0,
      "initializing_shards" : 0,
      "unassigned_shards" : 0,
      "shards" : {
        "0" : {
          "status" : "green",
          "primary_active" : true,
          "active_shards" : 1,
          "relocating_shards" : 0,
          "initializing_shards" : 0,
          "unassigned_shards" : 0
        },
        "1" : {
          "status" : "green",
          "primary_active" : true,
          "active_shards" : 1,
          "relocating_shards" : 0,
          "initializing_shards" : 0,
          "unassigned_shards" : 0
        },
        ... (same for the other shards)

```

Thank you

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [October 11, 2022, 3:20am UTC](https://discuss.elastic.co/t/alert-large-shard-size/316184/2 "2022-10-11T03:20:18Z")

</div>

Where is that alert coming from?

---

<div class="post-metadata">

**Author:** ![Michele\_De\_Benedet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/michele_de_benedet/32/100766_2.png) [@Michele\_De\_Benedet](https://discuss.elastic.co/u/Michele_De_Benedet)\
**Post date:** [October 11, 2022, 6:15am UTC](https://discuss.elastic.co/t/alert-large-shard-size/316184/3 "2022-10-11T06:15:00Z")

</div>

It is in the Kibana Stack Monitoring page

 ![Screenshot 2022-10-11 at 08.11.54](https://us1.discourse-cdn.com/elastic/original/3X/f/b/fba2fe7e220e2700c5e1b004f6a22436d0b6db80.png)

I did not mention, I am using version 7.12.0

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [October 11, 2022, 6:18am UTC](https://discuss.elastic.co/t/alert-large-shard-size/316184/4 "2022-10-11T06:18:39Z")

</div>

> [@Michele\_De\_Benedet](#):
>
> But how can it be? I am using 6 shards, each having a 10GB size. How can I fix it?

An index is made up of its component shards, and the alert only looks at index level.

I wouldn't be too worried about this to be honest, the alert isn't very smart and doesn't take into account specific use cases.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 8, 2022, 6:19am UTC](https://discuss.elastic.co/t/alert-large-shard-size/316184/5 "2022-11-08T06:19:27Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.