How change the number of shards and replicas in Elasticsearch

[emilio]

Dear all,

I need to decrease the number of shards and replicas in Elasticsearch.

I have just one node and there is no need to have more than one shard and zero replicas.

Please give me appropriate curl.

I couldn't find such API on elastic site.

Quick response will be greatly appreciated.

[dadoonet (David Pilato)]

You can't change the number of shards but you can reindex.
You can change the number of replicas.

[Christian_Dahlqvist]

If you are on Elasticsearch 5.x, you may also be able to use the shrink index API.

[emilio]

Dear Christian,

How can i do that correctly?

I have indices named logs-2017.05.XX. Every index has 5 shards and 0 replica.

I need shrink it to index with 1 shard and 0 replica, because my ES server is one node.

How can i settle it properly?

Another one question. My current indices ~ 90-100GB. What will be expected size of shinked index?

Does close operation of index help to decrease size of index?

[Christian_Dahlqvist]

If your current shard size is around 20GB you may not want to reduce the number of shards per index much, if at all.

[emilio]

But how can i get the size of shards in indices?

And how i can optimize size of indices? Should it be done on ES or filebeat side if i have text logs not having json format, but sended using json codec of filebeat?

[Christian_Dahlqvist]

The size the data takes up in Elasticsearch once indexed depends on how the data is mapped when indexed into Elasticsearch, and can be controlled and optimised through index templates. There is a blog post that discussed this, and even though it is a bit old most of it is still valid.