Index Template Not Apllying Correctly

[MultiplierMultiplier (G T)]

Hi All,

I have a cluster of ES nodes with 3 nodes in total, I would like two replica shards for each primary, I have implemented the below template which does not appear to work, any advice?

{
  "graylog-internal" : {
    "order" : 0,
    "template" : "graylog_*",
    "settings" : {
      "index" : {
        "number_of_shards" : "2",
        "number_of_replicas" : "2"
      }
    },
    "mappings" : {
      "message" : {
        "properties" : {
          "message" : {
            "type" : "text",
            "analyzer" : "standard",
            "fielddata" : false
          },
          "full_message" : {
            "type" : "text",
            "analyzer" : "standard",
            "fielddata" : false
          },
          "timestamp" : {
            "type" : "date",
            "format" : "yyyy-MM-dd HH:mm:ss.SSS"
          },
          "streams" : {
            "type" : "keyword"
          }
        },
        "dynamic_templates" : [
          {
            "internal_fields" : {
              "match" : "gl2_*",
              "mapping" : {
                "type" : "keyword"
              }
            }
          }
        ]
      }
    },
    "aliases" : { }
  }
}

The above is returned from curl -XGET 'localhost:9200/_template?pretty'

Regards,

George

[Ritesh_Uniyal]

your template should be like following. If the index already exists then you will need to rollover the index for template changes to take effect

{
"graylog-internal": {
"index_patterns": [
“Your pattern”
],
"settings": {
"index": {
"number_of_shards": “2”,
"number_of_replicas": "2",
"refresh_interval": "5s"
}
},
"mappings": {},
"aliases": {}
}
}

[victorhearnyeates]

If you want it to take effect on existing data, you'll need to reindex those indices, which can be done by reindex or update_by_query. Also be aware that shards and replicas aren't the same thing, shards partition data within an index, while replicas give you a separate copy, which can help with throughput.

i.e.

    POST _reindex
         {
          "source": {
            "index": "graylog-internal"
           },
           "dest": {
            "index": "new_graylog-internal"
          }
         }

or in-situ,

   POST graylog-internal/_update_by_query

As always, make sure you backup/snapshot before doing anything.

Hope this helps