I setup my logstash with defaults not knowing about the 5 shards per index default. I now have lots of days of logstash daily data and have over 1000 shards, so I'm running into the search issue with that threshold.
What is the best approach to modify the template to 1 shard per index and reindex all of my data?
So far on dev I modified the template for logstash-* for 1 shard and wrote a bash script to _reindex each logstash-DAY index into logstash-DAY-bu
This seems ok, but was wondering if there was a proper way to do this?
Thanks for your time.