# Help Understanding Sharding **URL:** \ **Category:** Elasticsearch\ **Created:** [May 2, 2019, 5:05pm UTC](https://discuss.elastic.co/t/help-understanding-sharding/179411 "2019-05-02T17:05:31Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![stefan2017](https://avatars.discourse-cdn.com/v4/letter/s/e79b87/32.png) [@stefan2017](https://discuss.elastic.co/u/stefan2017)\ **Post date:** [May 2, 2019, 5:05pm UTC](https://discuss.elastic.co/t/help-understanding-sharding/179411/1 "2019-05-02T17:05:31Z")
Greetings All, I'm a little fuzzy on the concept of sharding and have a few questions. My ElasticSearch cluster consists of 4 Linux nodes. Each node has a 1 TB data disk. I'm shipping IIS logs to the cluster using Filebeat. I have the following environments... NA1 - 12 web servers NA2 - 9 web servers NA3 - 12 web servers NA4 - 9 web servers STG - 4 web servers When I started shipping logs I noticed that only two ElasticSearch nodes were getting data. There was only a single primary shard and single replica shard (on separate servers). I was under the impression that ElasticSearch would have evenly distributed the data across all nodes. I want to achieve the following. Index Shards na1\_iis\_logs split into 4 shards na2\_iis\_logs split into 4 shards na3\_iis\_logs split into 4 shards na4\_iis\_logs split into 4 shards stg\_iis\_logs split into 4 shards How can I do this? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [May 2, 2019, 7:54pm UTC](https://discuss.elastic.co/t/help-understanding-sharding/179411/2 "2019-05-02T19:54:16Z")
What version are you on? ---
**Author:** ![elasticforme](https://avatars.discourse-cdn.com/v4/letter/e/f05b48/32.png) [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Post date:** [May 2, 2019, 8:42pm UTC](https://discuss.elastic.co/t/help-understanding-sharding/179411/3 "2019-05-02T20:42:34Z")
if I am not mistaken then each indice will be by default in to 5 seperate shard. and one replica. and all goes evently in to different datanode. you might have two node define as datanode. here are some command to see what is happenning ## Cluster Detail curl -XGET hostname:9200/\_cluster/health?pretty ## Node status curl -XGET hostname:9200/\_nodes/stats?pretty ## Shard Allocation detail curl -XGET hostname:9200/\_cluster/allocation/explain?pretty curl -XGET hostname:9200/\_cat/allocation?v ### See name of all indice curl -XGET hostname:9200/\_cat/indices?pretty ---
**Author:** ![DavidTurner](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/davidturner/32/22453_2.png) [@DavidTurner](https://discuss.elastic.co/u/DavidTurner)\ **Post date:** [May 2, 2019, 8:43pm UTC](https://discuss.elastic.co/t/help-understanding-sharding/179411/4 "2019-05-02T20:43:42Z")
> [@elasticforme](#): > > if I am not mistaken then each indice will be by default in to 5 seperate shard. This is true for versions prior to 7.0.0, but in 7.0.0 and later the default is 1 shard. ---
**Author:** ![elasticforme](https://avatars.discourse-cdn.com/v4/letter/e/f05b48/32.png) [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Post date:** [May 2, 2019, 8:48pm UTC](https://discuss.elastic.co/t/help-understanding-sharding/179411/5 "2019-05-02T20:48:52Z")
David, I just upgraded my cluster to 7.0.1 today. where is that setting then? ---
**Author:** ![DavidTurner](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/davidturner/32/22453_2.png) [@DavidTurner](https://discuss.elastic.co/u/DavidTurner)\ **Post date:** [May 2, 2019, 9:55pm UTC](https://discuss.elastic.co/t/help-understanding-sharding/179411/6 "2019-05-02T21:55:00Z")
> [@elasticforme](#): > > where is that setting then? I don't really understand. Do you mean the [`number_of_shards`](https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-create-index.html#create-index-settings) setting? There's no setting for the default behaviour, because it's the default behaviour. ---
**Author:** ![elasticforme](https://avatars.discourse-cdn.com/v4/letter/e/f05b48/32.png) [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Post date:** [May 3, 2019, 4:26pm UTC](https://discuss.elastic.co/t/help-understanding-sharding/179411/7 "2019-05-03T16:26:34Z")
yes how to change that default setting. because I would like to keep five shard for all my indice ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 31, 2019, 4:28pm UTC](https://discuss.elastic.co/t/help-understanding-sharding/179411/8 "2019-05-31T16:28:02Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.