How to change default of Elasticsearch

[waelco (wael)]

HI
how to change default of Elasticsearch 6.3 from five shards to more than 5 shards to kibana 5.1.1

Best regards

[Christian_Dahlqvist]

You can use an index template to control the number of shards. If you create one with "*" index pattern that matches everything, this will become the default. Be aware that Kibana 5.1.1 will not work with Elasticsearch 6.3.

[waelco (wael)]

Dear

where put the file of index template ?

notes the kibana work with elasticsearch 6.3

[waelco (wael)]

I try to put index template under /etc/elasticsearch/

after that restart services of elasticsearch.servic ,logstash.service and kibana

after that the kibana down

these configuration used
{
"index_patterns": ["te*", "bar*"],
"settings": {
"number_of_shards": 10
},
"mappings": {
"_doc": {
"_source": {
"enabled": false
},
"properties": {
"host_name": {
"type": "keyword"
},
"created_at": {
"type": "date",
"format": "EEE MMM dd HH:mm:ss Z YYYY"
}
}
}
}
}

[Christian_Dahlqvist]

You need to add the template through the Console application (Under Dev Tools) in Kibana. You also need to upgrade Kibana as you are likely to run into issues eventually as the are not compatible.

[waelco (wael)]

Dear I put Under Dev Tools and restart a services but nothing change

[Christian_Dahlqvist]

Try putting something like this:

PUT _template/default_shard_count
{
  "index_patterns": ["*"],
  "order" : 1000,
  "settings": {
    "number_of_shards": 1
  }
}

This will set the default primary shard count top 1 for all new indices and will allow you to overrode it as the order value is quite high.

[waelco (wael)]

Dear

I put this

PUT _template/default_shard_count
{
"index_patterns": ["*"],
"order" : 1000,
"settings": {
"number_of_shards": 10
}
}
after that restart services of elasticsearch.servic ,logstash.service and kibana but nothing change

[dadoonet (David Pilato)]

It's only applied to new indices. Not to old ones.

Also, I don't see the relationship between the number of shards and the screen capture you pasted. Could you explain what you are looking for?

[waelco (wael)]

Dear

this old one

GET _search

{

"query": {

"match_all": {}

}

}

after that change to
PUT _template/default_shard_count
{
"index_patterns": ["*"],
"order" : 1000,
"settings": {
"number_of_shards": 10
}
}
but the reason some nothing change . the kibana receives 5 servers

also i try put this code
PUT _template/template_1
{
"index_patterns": ["te*", "bar*"],
"settings": {
"number_of_shards": "*"
},
"mappings": {
"_doc": {
"_source": {
"enabled": false
},
"properties": {
"host_name": {
"type": "keyword"
},
"created_at": {
"type": "date",
"format": "EEE MMM dd HH:mm:ss Z YYYY"
}
}
}
}
}

also some nothing change

[Christian_Dahlqvist]

The template will only apply to new indices when they are created, not existing ones. If you want to change the number of primary shards for existing indices you need to use the shrink index or split index APIs.

[waelco (wael)]

Dear Eng

I check for shrink index the configuration put in Dev tools in the kibana or create file in server

PUT /my_source_index/_settings { "settings": { "index.routing.allocation.require._name": "shrink_node_name", "index.blocks.write": true } }

[waelco (wael)]

Dear Christian_Dahlqvist & dadoonet

i road about [shrink index]

but I confuse how i can do in server Linux7 ?
I try to put configuration int file /etc/elasticsearch/elasticsearch.yml
after that restart services elasticsearch then the kibana not work

kindly i wish know how add shrink to elasticsearch

notes
this is configuration used in the file /etc/elasticsearch/elasticsearch.yml

BR