Hello,
Currently all the data collected by the Elastic Agent integrations uses a default number of shards of 1 and a refresh interval of 1s, those configurations are not optimal for our use case and are starting to impact our cluster.
We want to change these numbers, but we couldn't find a place where we can do that once and the change is applied to all data streams.
First question is, where is the number_of_shards and refresh_interval being set? Is it hardcoded somewhere?
Also, each dataset in every integration has a template, the recommended way to make custom settings on templates is unmanageable as it requires to clone the template for every dataset and make changes, for example the Google Workspace integration has 14 datasets, we would need to manage 14 custom templates just for one integration.
Is there any template or component template that we could change to make those changes globally? It doesn't matter if it is a managed template if this is the only way.