Changing index template settings from default

I'd like to adjust the defaults on the generally default configuration of filebeat to reduce shards from the default of 5 to 1. Do I need to configure filebeats for this change to apply going forward, or can I do this using the ES PUT _template/template_1-style API? I see the default template index in ES, but am unclear the order that these are created/accessed. Any other things to be aware of when modifying filebeat settings like this?

I'm a bit new to it all, but preparing an existing cluster for a migration to Elastic Cloud (got a lot of cleanup to do first) so this is one aspect I want to tune sooner than later. I read the docs about this, but couldn't get a confident answer if a template index is created once by filebeat, or each time an index is added (daily, by the defaults), etc.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.