How can i change Elastic search 6.x shards to 1?

Hello

I would like to change from ssh the shards for latest Elastic search 6.x and my index name is "content".

I was using something like:

curl -XPUT http://localhost:9200/_template/content -H 'Content-Type: application/json' -d '
{
"template" : "content*",
"settings" : {
"number_of_shards": 1
},
"mappings" : {
"content" : {
}
}
}'

But it doesn't work as i see again the same default shards....

How can i adjust that and keep also the change permanent ?

Thank you

Did you get a response like "acknowledged" after you ran it?

If you use filebeat, look for the word shards in filebeat.yml. That is assuming you use filebeat to create your index pattern.

Yes i got the acknowledged response....

But when i check using:

curl 'localhost:9200/_stats?human&pretty'

I see the same default values.

I don't think so that i have that filebeat....

new shards are allocated on the next creation of the index.

Say you have an index filebeat-2019.09.24 and change whatever settings on its template. The next index creation, which would be 2019.09.25 is when the new index would grab the new settings and create it.

you can 1) wait until the next index creation date or, 2) reindex, which is to reindex, say, index A to index B, delete index A.
If you write to an alias, it should work fine, but if you must write to the original name of index A (for example, filebeat-2019.09.24) do the following:

  • reindex filebeat-2019.09.24 to filebeat-temp (will take some time depeding on disk speed, size of index, etc)
POST /_reindex
{
  "source": {
    "index": ["filebeat-2019.09.24j"]
  },
  "dest": {
    "index": "filebeat-temp"
  }
}
  • once the job completes, delete index filebeat-2019.09.24.
    GET _tasks?detailed=true&actions=*reindex
    (once no tasks show up)
    DELETE filebeat-2019.09.24
  • reindex a second time filebeat-temp into filebeat-2019.09.24, wait until completion
POST /_reindex
{
  "source": {
    "index": ["filebeat-temp"]
  },
  "dest": {
    "index": "ffilebeat-2019.09.24"
  }
}
  • delete filebeat-temp

Do i have to restart Elastic search ?

As i run again the above command and i got:

{"acknowledged":true}

Then i rebuild the index and all was ok but it reports again:

{
"_shards" : {
"total" : 13,
"successful" : 7,
"failed" : 0
},

:frowning:

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.