Thanks for using the format button there, made it heaps easier for me to read
Ok you're probably best off using the _reindex
API to merge some of these into monthly with a single shard. So something like;
PUT lcch-cisco-2018.03
POST _reindex
{
"source": {
"remote": {
"host": "http://localhost:9200"
},
"index": "lcch-cisco-2018.03.*"
},
"dest": {
"index": "lcch-cisco-2018.03"
}
}
Note that this assumes you have a template for the index pattern lcch-cisco-*
, otherwise when you create the lcch-cisco-2018.03
index, apply your own mapping manually.