# Beats write\_index causes single hotspots

**URL:** <https://discuss.elastic.co/t/beats-write-index-causes-single-hotspots/232393>\
**Category:** Elasticsearch\
**Created:** [May 13, 2020, 8:39am UTC](https://discuss.elastic.co/t/beats-write-index-causes-single-hotspots/232393 "2020-05-13T08:39:44Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![coudenysj](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/coudenysj/32/23108_2.png) [@coudenysj](https://discuss.elastic.co/u/coudenysj)\
**Post date:** [May 13, 2020, 8:39am UTC](https://discuss.elastic.co/t/beats-write-index-causes-single-hotspots/232393/1 "2020-05-13T08:39:45Z")

</div>

Hi,

I'm using beats to ship most of my data to elasticsearch. I'm using the suggested ILM in a hot-warm-cold setup, which works fine.

The biggest problem I see with the way beats utilizes the write\_indices with aliases, is that (even if I have 6 hot nodes), all of the current ingest traffic is going to that single hot node.

I have filebeat, metricbeat and heartbeat, so I can spread the load over these three write indices, but if I want to include more data in the filebeats, I'm not able to spread the load.

Any thoughts about how I can tackle this problem? Because I sometimes see bulk rejections (see [https://www.elastic.co/blog/why-am-i-seeing-bulk-rejections-in-my-elasticsearch-cluster](https://www.elastic.co/blog/why-am-i-seeing-bulk-rejections-in-my-elasticsearch-cluster)).

---

<div class="post-metadata">

**Author:** ![coudenysj](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/coudenysj/32/23108_2.png) [@coudenysj](https://discuss.elastic.co/u/coudenysj)\
**Post date:** [May 13, 2020, 10:25am UTC](https://discuss.elastic.co/t/beats-write-index-causes-single-hotspots/232393/2 "2020-05-13T10:25:55Z")

</div>

Ok, so after giving it some more thoughts, I just have to change the default number\_of\_shards from 1 to 3 (for example).

The "shrink" index option in the warm phase, will take care of the rest 🙂.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 10, 2020, 10:25am UTC](https://discuss.elastic.co/t/beats-write-index-causes-single-hotspots/232393/3 "2020-06-10T10:25:57Z")

</div>

Closed on June 10, 2020, 10:25am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.