# Is increasing cluster max shards is the best way of managing indies
**URL:** https://discuss.elastic.co/t/is-increasing-cluster-max-shards-is-the-best-way-of-managing-indies/195188
**Category:** Elasticsearch
**Created:** [August 14, 2019, 11:08am UTC](https://discuss.elastic.co/t/is-increasing-cluster-max-shards-is-the-best-way-of-managing-indies/195188 "2019-08-14T11:08:23Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@SCL\_ADMIN](https://discuss.elastic.co/u/SCL_ADMIN)
#### Post date: [August 14, 2019, 11:08am UTC](https://discuss.elastic.co/t/is-increasing-cluster-max-shards-is-the-best-way-of-managing-indies/195188/1 "2019-08-14T11:08:23Z")
Hello All
Starting logstash gave this error:
`Aug 13 10:07:30 SCL-SIEM-01 logstash[5784]: [2019-08-13T10:07:30,784][WARN][log stash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>4 00, :action=>["index", {:_id=>nil, :_index=>"filebeat-7.3.0-2019.08.13", :_type= >"_doc", :routing=>nil}, #LogStash::Event:0x54349926], :response=>{"index"=>{" _index"=>"filebeat-7.3.0-2019.08.13", "_type"=>"_doc", "_id"=>nil, "status"=>400 , "error"=>{"type"=>"validation_exception", "reason"=>"Validation Failed: 1: thi s action would add [2] total shards, but this cluster currently has [1000]/[1000] maximum shards open;"}}}}`
so I ran this command from Kibana to get around this problem:
```
PUT /_cluster/settings
{
"persistent": {
"cluster.max_shards_per_node": "1500"
}
}
```
Is increasing cluster max shards is the best way of managing indies ?
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [August 16, 2019, 6:48am UTC](https://discuss.elastic.co/t/is-increasing-cluster-max-shards-is-the-best-way-of-managing-indies/195188/2 "2019-08-16T06:48:34Z")
Why do you have so many shards per node? Having lots of small indices and shards can be very inefficient, so the limit is there to guard against that and prevent you from running into problems. If you have lots of small shards, e.g. due to a long retention period, I would recommend switching from daily to weekly or monthly indices, potentially with a single primary shard. Please read [this blog post](https://www.elastic.co/blog/how-many-shards-should-i-have-in-my-elasticsearch-cluster) for further guidance.
---
### Author:  [@SCL\_ADMIN](https://discuss.elastic.co/u/SCL_ADMIN)
#### Post date: [August 16, 2019, 9:00am UTC](https://discuss.elastic.co/t/is-increasing-cluster-max-shards-is-the-best-way-of-managing-indies/195188/3 "2019-08-16T09:00:09Z")
Thanks Christian,
Yes we do have a long retention period as cluster is collecting system logs ... i wil have a read of the blog post and report back.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 13, 2019, 9:00am UTC](https://discuss.elastic.co/t/is-increasing-cluster-max-shards-is-the-best-way-of-managing-indies/195188/4 "2019-09-13T09:00:12Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.