# Logstash shards with unaassigned replicas

**URL:** <https://discuss.elastic.co/t/logstash-shards-with-unaassigned-replicas/126600>\
**Category:** Logstash\
**Created:** [April 3, 2018, 3:42pm UTC](https://discuss.elastic.co/t/logstash-shards-with-unaassigned-replicas/126600 "2018-04-03T15:42:06Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![kostja79](https://avatars.discourse-cdn.com/v4/letter/k/3ec8ea/32.png) [@kostja79](https://discuss.elastic.co/u/kostja79)\
**Post date:** [April 3, 2018, 3:42pm UTC](https://discuss.elastic.co/t/logstash-shards-with-unaassigned-replicas/126600/1 "2018-04-03T15:42:06Z")

</div>

Hi to all,

I have a cluster with only 1 node.

However, when I start logstash, it creates several replicas of any shard:

```
GET /_cat/shards?h=index,shard,prirep,state,unassigned.reason 

logstash-2018.04.03 3 p STARTED    
logstash-2018.04.03 3 r UNASSIGNED INDEX_CREATED
logstash-2018.04.03 1 p STARTED    
logstash-2018.04.03 1 r UNASSIGNED INDEX_CREATED
logstash-2018.04.03 2 p STARTED    
logstash-2018.04.03 2 r UNASSIGNED INDEX_CREATED
logstash-2018.04.03 4 p STARTED    
logstash-2018.04.03 4 r UNASSIGNED INDEX_CREATED
logstash-2018.04.03 0 p STARTED    
logstash-2018.04.03 0 r UNASSIGNED INDEX_CREATED

```

How can I prevent the creation of the replicas when I have only 1 node?

I tried to modify the setting "number\_of\_replicas" in the template, but probably it has been overriden when logstash started.

Thanks

---

<div class="post-metadata">

**Author:** ![Evesy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/evesy/32/29520_2.png) [@Evesy](https://discuss.elastic.co/u/Evesy)\
**Post date:** [April 3, 2018, 5:45pm UTC](https://discuss.elastic.co/t/logstash-shards-with-unaassigned-replicas/126600/2 "2018-04-03T17:45:40Z")

</div>

Hey Kostja,

You can verify if the template has been overwritten by hitting the Elasticsearch API: `GET {{url}}:9200/_template/logstash` -- This should show how many replicas the Logstash template has configured.

However one thing to note is that the template is only used on the creation of new indices, so if your index `logstash-2018.04.03` already exists, changing the template won't have any affect on that index. Instead you can see the settings for that index: `GET {{url}}:9200/logstash-2018.04.03/_settings`. If you wish to change the number of replicas on an existing index you can do that with the below:

`PUT {{url}}:9200/logstash-2018.04.03/_settings`

```
{
  "index": {
	"number_of_replicas": "1"
  }
}

```

I'm not intimately familiar with the default Logstash templates, but I imagine it won't override anything is a template already exists.

Hope this helps, let me know how you get on

Cheers,  
Mike

---

<div class="post-metadata">

**Author:** ![kostja79](https://avatars.discourse-cdn.com/v4/letter/k/3ec8ea/32.png) [@kostja79](https://discuss.elastic.co/u/kostja79)\
**Post date:** [April 4, 2018, 7:26am UTC](https://discuss.elastic.co/t/logstash-shards-with-unaassigned-replicas/126600/3 "2018-04-04T07:26:19Z")

</div>

Hi Mike,

thanks for your reply.

This is the output of GET \_template/logstash\*:  
{  
"logstash-index-template": {  
"order": 0,  
"index\_patterns": [  
".logstash"  
],  
"settings": {  
"index": {  
"number\_of\_shards": "1",  
"auto\_expand\_replicas": "0-1",  
"codec": "best\_compression"  
}  
},  
....

So, basing on the value of auto\_expand\_replicas, I was expecting that no replicas should be created since I have only 1 node. I do not understand why it creates the replicas.

No problem for the already created indices, I am focused to avoid this issue for the new indices.

Thanks  
kostja

---

<div class="post-metadata">

**Author:** ![kostja79](https://avatars.discourse-cdn.com/v4/letter/k/3ec8ea/32.png) [@kostja79](https://discuss.elastic.co/u/kostja79)\
**Post date:** [April 5, 2018, 7:36am UTC](https://discuss.elastic.co/t/logstash-shards-with-unaassigned-replicas/126600/4 "2018-04-05T07:36:41Z")

</div>

Hi, I solved this issue.

It has been originated by filebeat where there was the following setting:  
`index.number_of_shards: 3`

I changed to `index.number_of_shards: 1` and now logstash does not create unallocated shards.

For the current load of my cluster it is fine, I'm going to change it when the load will grow.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 3, 2018, 7:36am UTC](https://discuss.elastic.co/t/logstash-shards-with-unaassigned-replicas/126600/5 "2018-05-03T07:36:52Z")

</div>

Closed on May 3, 2018, 7:36am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.