My logstash is indexing to a dynamic index "sample-%(YYYY.MM.DD)"). I have assigned Primary Shards and Replica shards as 3 and 2 respectively. But when logstash sends to the dynamic index it's creating an index(sample-2017.08.17) with 5 primary shards and 1 replica. Why is it not 3 Primary and 2 Replica?
I understand what is the issue here. What you have created there is an actual index named "sample". But what you need to create is an Index Template so when you create any index that matches "sample-*" it will use the settings from the template.
I think I will need to add number_of_replicas field to settings. I don't understand the purpose of mapping, properties, created at blocks. Can you please explain it?
Defining a mapping manually is required when you want to fine-tune how Elasticsearch process documents. It is all explained here. But if you just starting with Elasticsearch, you don't need to worry about it, as Elasticsearch can automatically autodetect the mapping when new documents are indexed.
But at this point I am not using "Type" concept for indexing. So, am I still good to use Index template API? And can you also let me know the advantage of using Type/Mapping? Once elasticsearch has good amount of documents then I will need to use Type concept?
This is not really because of Type (types will be deprecated anyway). You need an index template so every time you create a "sample-*" index then the same settings will be reused.
Your initial problem was that you created 2 indices: an index named "sample" and another one following "sample-%{+YYYY.MM.dd}". That's not how it works, to be able to reuse the settings that you have used when creating "sample" index you need to create an Index Template.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.