I'd like to adjust the defaults on the generally default configuration of filebeat to reduce shards from the default of 5 to 1. Do I need to configure filebeats for this change to apply going forward, or can I do this using the ES PUT _template/template_1-style API? I see the default template index in ES, but am unclear the order that these are created/accessed. Any other things to be aware of when modifying filebeat settings like this?
I'm a bit new to it all, but preparing an existing cluster for a migration to Elastic Cloud (got a lot of cleanup to do first) so this is one aspect I want to tune sooner than later. I read the docs about this, but couldn't get a confident answer if a template index is created once by filebeat, or each time an index is added (daily, by the defaults), etc.