Editing a system template can break Kibana

[juancamiloll]

Hello to all,

I need to use an index template to assign 3 shards and 1 replica but this warning message leaves me a bit uneasy.

I appeal to your experience to please tell me if I can do this process or if I better not touch this configuration.

Thank you very much

[stephenb (Stephen Brown)]

Hi @juancamiloll

What version of the stack are you on?

Also I am have trouble finding that template … where did it come from?

That looks like metricbeat logstash monitoring?

A couple other questions … Why do you need 3 shards… how much Data / GB / day is ingesting into that index… its monitoring data so usually that is low volume… so why 3 shards…

tl;dr changing the shards / replicas will probably not actually break anything BUT when you do an update (metricbeat or whatever owns that template) your changes may be overwritten.

[juancamiloll]

I am on version 8.18.1

I only know that those were the shards and replicas that were defined, I have no more context.

[stephenb (Stephen Brown)]

@juancamiloll

I need to use an index template to assign 3 shards and 1 replica but this warning message leaves me a bit uneasy.

@juancamiloll

I only know that those were the shards and replicas that were defined, I have no more context.

I mean why to you NEED to change those settings in the first place. That is a pretty unusual change... its OK ... but generally no need to change.

You can change it, but those settings may be overridden when you upgrade again.