How do you change the default number of shards?

Elastic Stack Elasticsearch
1

I'm trying to reduce my logstash shards per index down from 5 to 2. (Due to this conversation)

I've downloaded my template.

curl -XGET $ELK/_template/logstash > logstash-template.json

Then I've modified the settings field.

"settings" : {
        "number_of_shards" : 2
    },

However, when I try and upload the template, I get this error

curl -XPUT "$ELK/_template/logstash" -d@logstash-template.json
{"error":"ActionRequestValidationException[Validation Failed: 1: template is missing;]","status":400}

Is this the correct way to change the default number of shards per index? If so, what does this error mean?

2 Likes
2

The output from /_template/logstash isn't the same as the expected format of a template when posting to ES. If you look at the index template documentation and compare it with logstash-template.json you'll note that the latter has a top-level "logstash" field that shouldn't be there. So the index template you send to ES should look like this:

{
  "template": "logstash-*",
  "settings": {
    "number_of_shards": 2
  },
  ...
}
1 Like
3

Thanks,

So just to clarify, I should take my logstash-template.json and convert it from this:

{
  "logstash" : {
    "order" : 0,
    "template" : "logstash-*",
    "settings" : {
      "number_of_shards": 2
    },
    "mappings" : {
      "_default_" : {
...

to this

{
    "template" : "logstash-*",
    "settings" : {
      "number_of_shards": 2
    },
    "mappings" : {
      "_default_" : {
2 Likes
4

This appears to have worked.

I've blogged the full procedure here for posterity.

http://spuder.github.io/elasticsearch,/logstash/elasticsearch-default-shards/

5

Above link is not working.. Please provide the updated link.

6

The new link is here:

2 Likes