Increase no of shared not working (template update)

[Senthil_ak (Senthil kumar)]

Hi,
I have 3 master nodes and 3 data nodes running in elk. Beats sends logs to log stash and then to elk. The index name created from log stash o/p like below.

elasticsearch {
  hosts => ["http://host1:9200","http://host2:9200","http://host3:9200"]
  manage_template => false
  index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"

Everything work fine, but now the all index are created with number of shards as '1'. I though of increasing it to 2 ~ 3. So by referring the link template i created a default file beat template like below. But all my indexes are creating with only one shards and one replicas.

{
  "filebeat" : {
    "order" : 0,
    "index_patterns" : [
      "filebeat-*"
    ],
    "settings" : {
      "index" : {
        "number_of_shards" : "3",
        "number_of_replicas" : "1"
      }
    },
    "mappings" : { },
    "aliases" : { }
  }
}

How to check what am i doing wrong ?

filebeat-7.2.0-2020.02.21 0 r STARTED 2163281 
filebeat-7.2.0-2020.02.21 0 p STARTED 2163276

[spinscale (Alexander Reelsen)]

Wild guess here: Is there another index template, that also matches the index pattern, that has a higher order and thus overwrites this number_of_shards setting again?

See https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-templates.html#put-index-template-api-query-params

[Senthil_ak (Senthil kumar)]

Yes you are right, there was a filebeat template and a filebeat-7.2.0 which is causing issues, i deleted both of them and now the default is taking care of the shards.