# How to split ".security-7"
**URL:** https://discuss.elastic.co/t/how-to-split-security-7/317807
**Category:** Elasticsearch
**Tags:** elastic-stack-security
**Created:** [October 31, 2022, 10:12am UTC](https://discuss.elastic.co/t/how-to-split-security-7/317807 "2022-10-31T10:12:10Z")
**Posts on this page:** 20
**Page:** 1
### Author:  [@MuFeng](https://discuss.elastic.co/u/MuFeng)
#### Post date: [October 31, 2022, 10:12am UTC](https://discuss.elastic.co/t/how-to-split-security-7/317807/1 "2022-10-31T10:12:10Z")
Why can't I add multiple copies of. security-7 in the ES8 cluster? How to modify the number of replicas of the system index?
---
### Author:  [@MuFeng](https://discuss.elastic.co/u/MuFeng)
#### Post date: [October 31, 2022, 10:21am UTC](https://discuss.elastic.co/t/how-to-split-security-7/317807/2 "2022-10-31T10:21:17Z")
". security-7" I want to distribute this index among storage nodes, but it cannot be implemented in es8. x, and I want to find a solution.
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [October 31, 2022, 11:23pm UTC](https://discuss.elastic.co/t/how-to-split-security-7/317807/3 "2022-10-31T23:23:22Z")
Welcome to our community! 😃
By default, that index has this setting;
```auto
"settings": {
"index": {
"refresh_interval": "1s",
"hidden": "true",
"auto_expand_replicas": "0-1",
```
That means it'll add replicas as it can. How many nodes do you have in your cluster?
---
### Author:  [@MuFeng](https://discuss.elastic.co/u/MuFeng)
#### Post date: [November 1, 2022, 1:38am UTC](https://discuss.elastic.co/t/how-to-split-security-7/317807/6 "2022-11-01T01:38:32Z")
My es cluster has five storage nodes and three management nodes, but There is only one copy of security-7
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [November 1, 2022, 1:42am UTC](https://discuss.elastic.co/t/how-to-split-security-7/317807/7 "2022-11-01T01:42:06Z")
What's the output from `GET _cat/indicies/.security*?v`?
---
### Author:  [@MuFeng](https://discuss.elastic.co/u/MuFeng)
#### Post date: [November 1, 2022, 2:22am UTC](https://discuss.elastic.co/t/how-to-split-security-7/317807/8 "2022-11-01T02:22:40Z")
Its output is as follows:{"error":"no handler found for uri [/\_cat/indicies/.security\*?v?] and method [GET]"}
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [November 1, 2022, 2:23am UTC](https://discuss.elastic.co/t/how-to-split-security-7/317807/9 "2022-11-01T02:23:54Z")
The last `?` is outside the code quotes, that's not clear sorry. Just - `GET _cat/indicies/.security*?v`.
---
### Author:  [@MuFeng](https://discuss.elastic.co/u/MuFeng)
#### Post date: [November 1, 2022, 2:46am UTC](https://discuss.elastic.co/t/how-to-split-security-7/317807/10 "2022-11-01T02:46:49Z")
The output is as follows: "error": "no handler found for uri [/\_cat/indicies/.security\*?v=&pretty=true] and method [GET]"
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [November 1, 2022, 2:50am UTC](https://discuss.elastic.co/t/how-to-split-security-7/317807/11 "2022-11-01T02:50:45Z")
Ahh there is a typo I missed - `GET _cat/indices/.security*?v`. There is no second `i` in indices!
---
### Author:  [@MuFeng](https://discuss.elastic.co/u/MuFeng)
#### Post date: [November 1, 2022, 2:55am UTC](https://discuss.elastic.co/t/how-to-split-security-7/317807/14 "2022-11-01T02:55:18Z")
> health status index uuid pri rep docs.count docs.deleted store.size pri.store.size
> green open .security-7 c2xBKwkbR326pV45SxMoeQ 1 1 111 0 658.1kb 327.3kb
---
### Author:  [@MuFeng](https://discuss.elastic.co/u/MuFeng)
#### Post date: [November 1, 2022, 3:09am UTC](https://discuss.elastic.co/t/how-to-split-security-7/317807/15 "2022-11-01T03:09:37Z")
Can this index be modified manually? Or what configuration errors can prevent more copies of my index from appearing?
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [November 1, 2022, 3:10am UTC](https://discuss.elastic.co/t/how-to-split-security-7/317807/16 "2022-11-01T03:10:24Z")
Ok you can see that it has a single primary and a single replica allocated there, which matches the `auto_expand_replicas` setting as mentioned.
You can update the template and/or the index to increase that, but it will likely be overwritten if you upgrade.
---
### Author:  [@MuFeng](https://discuss.elastic.co/u/MuFeng)
#### Post date: [November 2, 2022, 12:53am UTC](https://discuss.elastic.co/t/how-to-split-security-7/317807/17 "2022-11-02T00:53:10Z")
I also tried to use "put" to make changes, but failed.
This method can be used on the ES7 cluster, but cannot be updated in the ES8 cluster.
And I use "GET \_cat/templates",You cannot see the template for ". security-7".
---
### Author:  [@Yang\_Wang](https://discuss.elastic.co/u/Yang_Wang)
#### Post date: [November 2, 2022, 2:49am UTC](https://discuss.elastic.co/t/how-to-split-security-7/317807/18 "2022-11-02T02:49:13Z")
This is not possible in version 8. System indices (security index is one of them) pre-configure certain settings and they cannot be manually overriden.
Maybe we should take a step back: Other than having multiple data nodes, do you have a strong reason for changing the number of replicas? Do you have evidence that having a single replica is causing performance issue? Many security related operations are heavily cached. I'd be interested in seeing any underlying issues before jumping to the conclusion of increasing number of replicas.
---
### Author:  [@MuFeng](https://discuss.elastic.co/u/MuFeng)
#### Post date: [November 2, 2022, 4:09am UTC](https://discuss.elastic.co/t/how-to-split-security-7/317807/19 "2022-11-02T04:09:44Z")
In the environment, if I have a partition, I cannot effectively guarantee security. It is very likely that nodes with '. security-7' will be disconnected at the same time. Therefore, I want '. security-7' to have more copies to ensure cluster security.
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [November 2, 2022, 10:02pm UTC](https://discuss.elastic.co/t/how-to-split-security-7/317807/20 "2022-11-02T22:02:02Z")
Why would you have a partition?
---
### Author:  [@MuFeng](https://discuss.elastic.co/u/MuFeng)
#### Post date: [November 3, 2022, 12:53am UTC](https://discuss.elastic.co/t/how-to-split-security-7/317807/21 "2022-11-03T00:53:26Z")
> [@warkolm](#):
>
> Why would you have a partition?
Oh, I'm sorry, it's split if If security-7 has only one partition, my cluster cannot effectively ensure security, such as two storage If the nodes of security-7 are offline at the same time, my cluster may not work normally.
---
### Author:  [@Yang\_Wang](https://discuss.elastic.co/u/Yang_Wang)
#### Post date: [November 7, 2022, 3:44am UTC](https://discuss.elastic.co/t/how-to-split-security-7/317807/22 "2022-11-07T03:44:24Z")
I'd like to clarify that when both shards for the security index become unavailable, any security related operations relying on the security index will fail. In another word, the cluster will fail closed, i.e. no security vulnerability.
That said, it does mean the cluster will become largely unsable because every request needs authentication which will fail. In this case, the current suggestion is to prioritize bringing the offline security shards back on again before anything else.
---
### Author:  [@MuFeng](https://discuss.elastic.co/u/MuFeng)
#### Post date: [November 14, 2022, 1:58am UTC](https://discuss.elastic.co/t/how-to-split-security-7/317807/23 "2022-11-14T01:58:29Z")
What if I don't want to make my cluster unusable due to the failure of two partitions of the security index? Therefore, I want to increase the partition of the security index to make it more secure.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 12, 2022, 1:58am UTC](https://discuss.elastic.co/t/how-to-split-security-7/317807/24 "2022-12-12T01:58:39Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.