# Fleet "CreateIndexRequest" constantly rollover indicies **URL:** \ **Category:** Beats\ **Tags:** fleet\ **Created:** [September 8, 2023, 11:06am UTC](https://discuss.elastic.co/t/fleet-createindexrequest-constantly-rollover-indicies/342604 "2023-09-08T11:06:30Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Anabel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anabel/32/123639_2.png) [@Anabel](https://discuss.elastic.co/u/Anabel)\ **Post date:** [September 8, 2023, 11:06am UTC](https://discuss.elastic.co/t/fleet-createindexrequest-constantly-rollover-indicies/342604/1 "2023-09-08T11:06:30Z")
Hi everyone Elasticsearch was complaining that we've reached max amount of shards -- we've increased max\_shards\_per\_node from default 1000 to 2000 and later to 5000. and then we noticed hundreds of empty indices with 0 documents. Investigation showed that Fleet is running rollover on all APM indies without any (obvious for us) reason. currently we are on index-000080, even if index was create few days ago, is less than 10 GB `{"type":"audit", "timestamp":"2023-09-05T11:33:39,022+0000", "node.id":"XXX", "event.type":"transport", "event.action":"access_granted", "user.name":"elastic/fleet-server", "user.realm":"_service_account", "user.roles":["elastic/fleet-server"], "origin.type":"transport", "origin.address":"XXX", "request.id":"XXX", "action":"indices:admin/auto_create", "request.name":"CreateIndexRequest", "indices":["traces-apm"], "x_forwarded_for":"XXX"}` ILM is stopped ( as first idea was that ILM is getting crazy). This triggers hot nodes being overloaded and going down. Fleet just exploded amount of shards to 31K shards (expected amount -- less than 6K). all new shards have 0 documents, rollover should be on 000001-0000010, but currently is on 000080. we manually deleted all empty indices, to protect our hot nodes from overloading. max\_shards\_per\_node was lowered back to 1000 (was 2500 and 5000)., That is also stopping Fleet from rollovering our indices. **How to check why Fleet is triggered?** logs or Fleet UI doesn't show anything related. Just a fact of index creation. ---
**Author:** ![DavidTurner](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/davidturner/32/22453_2.png) [@DavidTurner](https://discuss.elastic.co/u/DavidTurner)\ **Post date:** [September 30, 2023, 6:01am UTC](https://discuss.elastic.co/t/fleet-createindexrequest-constantly-rollover-indicies/342604/2 "2023-09-30T06:01:02Z")
This was opened in the Elasticsearch forum but I don't think it relates to Elasticsearch - ES is just doing what Fleet Server tells it to. I don't think we have a forum specifically for Fleet Server so I've moved it to the Beats forum. ---
**Author:** ![Julia\_Bardi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/julia_bardi/32/79463_2.png) [@Julia\_Bardi](https://discuss.elastic.co/u/Julia_Bardi)\ **Post date:** [October 9, 2023, 1:59pm UTC](https://discuss.elastic.co/t/fleet-createindexrequest-constantly-rollover-indicies/342604/3 "2023-10-09T13:59:27Z")
Hi Anabel, I think this is related to a known [issue](https://github.com/elastic/kibana/issues/164269) with apm package installation that we recently fixed in 8.10.3, that is just coming out this week. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 6, 2023, 1:59pm UTC](https://discuss.elastic.co/t/fleet-createindexrequest-constantly-rollover-indicies/342604/4 "2023-11-06T13:59:52Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.