# Incorrect number of shard, what is the possible reason?

**URL:** <https://discuss.elastic.co/t/incorrect-number-of-shard-what-is-the-possible-reason/239582>\
**Category:** Elasticsearch\
**Created:** [July 2, 2020, 7:37am UTC](https://discuss.elastic.co/t/incorrect-number-of-shard-what-is-the-possible-reason/239582 "2020-07-02T07:37:08Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![mmk1995](https://avatars.discourse-cdn.com/v4/letter/m/8797f3/32.png) [@mmk1995](https://discuss.elastic.co/u/mmk1995)\
**Post date:** [July 2, 2020, 7:37am UTC](https://discuss.elastic.co/t/incorrect-number-of-shard-what-is-the-possible-reason/239582/1 "2020-07-02T07:37:09Z")

</div>

Hello,

The default number of shard is 5 in the yml setting. I also didn't specify any template for all logstash config.  
Most of the index are with correct number of shards,  
However, some index appears to be only 1 primary shard.  
I search all over the internet and cannot find relevant problem.  
What could be the possible reason?

 ![temp](https://us1.discourse-cdn.com/elastic/original/3X/1/d/1d14cd60aa40f829a281d2d8b4c698a5db6592b3.png)

---

<div class="post-metadata">

**Author:** ![Wolfram\_Haussig](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wolfram_haussig/32/70528_2.png) [@Wolfram\_Haussig](https://discuss.elastic.co/u/Wolfram_Haussig)\
**Post date:** [July 2, 2020, 7:47am UTC](https://discuss.elastic.co/t/incorrect-number-of-shard-what-is-the-possible-reason/239582/2 "2020-07-02T07:47:50Z")

</div>

Hello Matthew,

Did you already check if there is an index template for this index where the setting is overwritten? Or could it be that the indexes where created before the setting was changed(The `number_of_shards` setting only applies at creation date).

Index templates can be checked by the ElasticSearch API:

```auto
GET _template

```

Best regards  
Wolfram

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [July 2, 2020, 7:59am UTC](https://discuss.elastic.co/t/incorrect-number-of-shard-what-is-the-possible-reason/239582/3 "2020-07-02T07:59:27Z")

</div>

Did you upgrade elasticsearch version?  
Old versions of elasticsearch were using 5 shards by default. New versions are using 1 shard. Looks like new indices have 1 shard.

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [July 2, 2020, 8:25am UTC](https://discuss.elastic.co/t/incorrect-number-of-shard-what-is-the-possible-reason/239582/4 "2020-07-02T08:25:03Z")

</div>

Given the size of your indices having a single primary shard seems much more appropriate than having 5.

---

<div class="post-metadata">

**Author:** ![mmk1995](https://avatars.discourse-cdn.com/v4/letter/m/8797f3/32.png) [@mmk1995](https://discuss.elastic.co/u/mmk1995)\
**Post date:** [July 2, 2020, 8:30am UTC](https://discuss.elastic.co/t/incorrect-number-of-shard-what-is-the-possible-reason/239582/5 "2020-07-02T08:30:24Z")

</div>

Yes! that shoul be the case. Why would the default shard change from 5 to 1?  
How large in size should be appropriate to have more shards?

---

<div class="post-metadata">

**Author:** ![mmk1995](https://avatars.discourse-cdn.com/v4/letter/m/8797f3/32.png) [@mmk1995](https://discuss.elastic.co/u/mmk1995)\
**Post date:** [July 2, 2020, 8:32am UTC](https://discuss.elastic.co/t/incorrect-number-of-shard-what-is-the-possible-reason/239582/6 "2020-07-02T08:32:40Z")

</div>

what size should be more appropriate per shard?

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [July 2, 2020, 8:36am UTC](https://discuss.elastic.co/t/incorrect-number-of-shard-what-is-the-possible-reason/239582/7 "2020-07-02T08:36:23Z")

</div>

I would recommend aiming for an average shard size of around at least 10GB. If you have a long retention period you could go with a single primary shard and weekly or monthly indices rather than daily. [This blog post](https://www.elastic.co/blog/how-many-shards-should-i-have-in-my-elasticsearch-cluster) contains additional details.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 30, 2020, 8:36am UTC](https://discuss.elastic.co/t/incorrect-number-of-shard-what-is-the-possible-reason/239582/8 "2020-07-30T08:36:32Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
