Change default shard

Elastic Stack Elasticsearch
1

in old ELK default number of shard was 5.

I upgraded to 7.0.1 and now it is set to 1.

how do I change this to default 5?

2

Alright found the command and it does change everything to what I want. But I only want indice that I create to be 5 and all system indice to 1.
That is how it was set in 6.X. why do elk have to change that.

PUT /_template/index_defaults 
{
  "index_patterns": "*", 
  "settings": {
    "number_of_shards": 5
  }
}
3

Have a look at https://www.elastic.co/blog/elasticsearch-7-0-0-released

4

David,
Read the post.
I can completely understand when you have one indice per day*shard, that is too much.

but in my case I have all of my indice by year index-YYYY and so if I have five shard it will serve me result faster isn't it vs one shard?

5

Not really. One single shard if not overloaded will be faster.