Increase no of shared not working (template update)

I have 3 master nodes and 3 data nodes running in elk. Beats sends logs to log stash and then to elk. The index name created from log stash o/p like below.

elasticsearch {
  hosts => ["http://host1:9200","http://host2:9200","http://host3:9200"]
  manage_template => false
  index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"

Everything work fine, but now the all index are created with number of shards as '1'. I though of increasing it to 2 ~ 3. So by referring the link template i created a default file beat template like below. But all my indexes are creating with only one shards and one replicas.

  "filebeat" : {
    "order" : 0,
    "index_patterns" : [
    "settings" : {
      "index" : {
        "number_of_shards" : "3",
        "number_of_replicas" : "1"
    "mappings" : { },
    "aliases" : { }

How to check what am i doing wrong ?

filebeat-7.2.0-2020.02.21 0 r STARTED 2163281 
filebeat-7.2.0-2020.02.21 0 p STARTED 2163276

Wild guess here: Is there another index template, that also matches the index pattern, that has a higher order and thus overwrites this number_of_shards setting again?


Yes you are right, there was a filebeat template and a filebeat-7.2.0 which is causing issues, i deleted both of them and now the default is taking care of the shards.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.