All segments in Elasticsearch are immutable, so when merging takes place new merged segments need to be created before old, redundant ones can be deleted. This will lead to the reported shard size fluctuating over time like you captured here. I believe ILM do not just look at the raw current shard size (which would frequently be affected by merging) but instead estimates the merged size.
1 Like