# Best way to convert existing logstash indexes from 5 to 1 shards

**URL:** <https://discuss.elastic.co/t/best-way-to-convert-existing-logstash-indexes-from-5-to-1-shards/99609>\
**Category:** Elasticsearch\
**Created:** [September 6, 2017, 3:39pm UTC](https://discuss.elastic.co/t/best-way-to-convert-existing-logstash-indexes-from-5-to-1-shards/99609 "2017-09-06T15:39:22Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Stuart\_Allen](https://avatars.discourse-cdn.com/v4/letter/s/8edcca/32.png) [@Stuart\_Allen](https://discuss.elastic.co/u/Stuart_Allen)\
**Post date:** [September 6, 2017, 3:39pm UTC](https://discuss.elastic.co/t/best-way-to-convert-existing-logstash-indexes-from-5-to-1-shards/99609/1 "2017-09-06T15:39:22Z")

</div>

I setup my logstash with defaults not knowing about the 5 shards per index default. I now have lots of days of logstash daily data and have over 1000 shards, so I'm running into the search issue with that threshold.  
What is the best approach to modify the template to 1 shard per index and reindex all of my data?

So far on dev I modified the template for logstash-\* for 1 shard and wrote a bash script to \_reindex each logstash-DAY index into logstash-DAY-bu

This seems ok, but was wondering if there was a proper way to do this?

Thanks for your time.

---

<div class="post-metadata">

**Author:** ![jpountz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jpountz/32/45836_2.png) [@jpountz](https://discuss.elastic.co/u/jpountz)\
**Post date:** [September 6, 2017, 4:13pm UTC](https://discuss.elastic.co/t/best-way-to-convert-existing-logstash-indexes-from-5-to-1-shards/99609/2 "2017-09-06T16:13:15Z")

</div>

You can use the \_shrink API. [https://www.elastic.co/guide/en/elasticsearch/reference/5.6/indices-shrink-index.html](https://www.elastic.co/guide/en/elasticsearch/reference/5.6/indices-shrink-index.html)

---

<div class="post-metadata">

**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\
**Post date:** [September 6, 2017, 4:26pm UTC](https://discuss.elastic.co/t/best-way-to-convert-existing-logstash-indexes-from-5-to-1-shards/99609/3 "2017-09-06T16:26:31Z")

</div>

Curator 5.2 [now has a shrink action](https://www.elastic.co/guide/en/elasticsearch/client/curator/current/shrink.html) to help with this.

---

<div class="post-metadata">

**Author:** ![Stuart\_Allen](https://avatars.discourse-cdn.com/v4/letter/s/8edcca/32.png) [@Stuart\_Allen](https://discuss.elastic.co/u/Stuart_Allen)\
**Post date:** [September 6, 2017, 6:17pm UTC](https://discuss.elastic.co/t/best-way-to-convert-existing-logstash-indexes-from-5-to-1-shards/99609/4 "2017-09-06T18:17:05Z")

</div>

Thanks guys, I'll check this out.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 4, 2017, 6:17pm UTC](https://discuss.elastic.co/t/best-way-to-convert-existing-logstash-indexes-from-5-to-1-shards/99609/5 "2017-10-04T18:17:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.