Index settings or templates changed back overnight

[Constantin07 (Constantin Bugneac)]

Hi All,

I've tried to change the index settings (templates too) for the below special (+X-Pack) indexes from 1 primary 0 replica to 1 primary 2 replicas but overnight the settings have been changed back.

Let's say for .kibana, I would like to have at least one replica in case it gets corrupted or the node with it gets down in a cluster. In this case all users cannot use Kibana as .kibana index is unreachable.

.kibana
.logstash
.ml-notifications
.ml-state
.monitoring-es-6-
.monitoring-logstash-6-*
.security-6
.triggered_watches
.watcher-history-7-*
.watches

I know that these are special indexes.

Could someone explain if it's possible to make persistent changes to them and how?
By changes I mean modifying number or shards & replicas.

Regards,
Constantin

[JKhondhu (Jymit Singh Khondhu)]

Utilising the support contract in place we come to:

If you look at:
GET .kibana/_settings
GET .security/_settings
GET .monitoring-es-6-*/_settings

You will see dynamic index settings are in place: https://www.elastic.co/guide/en/elasticsearch/reference/6.2/index-modules.html#dynamic-index-settings
index.auto_expand_replicas:
Auto-expand the number of replicas based on the number of available nodes. Set to a dash delimited lower and upper bound (e.g. 0-5) or use all for the upper bound (e.g. 0-all). Defaults to false(i.e. disabled).

Essentially, depending on how many nodes you have in your cluster, these system indices will expand replicas as per the needs of redundancy.

[Constantin07 (Constantin Bugneac)]

Thanks Jymit.