Elasticsearch shards size increase sometimes

Elastic Stack Elasticsearch
1

I have a time based index called log-wlb-sysmon-2021.03.13 its index size is 19gb with replication 38gb.I created 2 shards(1p+1r)
Sometimes its size increases from 38gb to 44gb.I am using ilm policy for this index in that if this index size reaches 50gb create the new index but this can increase the shards in cluster because we have planned that the cluster can have this amount of shards

2

If index size is 50gb(included replica) does it mean that its shard size is 50gb ?

3

The rollover threshold is based on primary size.

4

If we say our data size is 20gb then primary shard is of 20gb and its replica shard is of 20gb then total index size is of 40gb.If i am using ilm policy for this then after 50gb it will create new index and average shard size is of 10 to 50gb which is optimal in my case

5

You can increase or decrease the number of replicas at any time so not basing size on primary shard size could lead to odd results.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.