We have an ES cluster storing events for about 10 different applications. Each applications events are stored in an index specific to that application (the apps are unrelated), and a new index is created daily for each application (i.e. app1-2016.05.04, app1-2016.05.05, app2-2016.05.04........etc.). Creation of the indices for some of the applications use templates, some just take the ES defaults. In all cases we're using the default of 5 primary shards, however we want to lower that to 3 primary shards per index/per day.
How do we make this update so that the "next" days indices, and all future indices get created with only the 3 primary shards? I know you can't make this static update to the already-created indexes without going through a re-indexing, so how do we change both the default index template and our custom templates so that at 12:00am, when the next days indexes are created they only have 3 shards?
Appreciate your feedback.