Metricbeat indices default to 5 shards

[robscott27]

I'm a little stumped on this one, though I feel like it's something easy that I'm missing.

In both cases, updating to 6.2.4 sets the default number of shards in new indices to 5. Even though this: index.number_of_shards: 1 is set to one in the metricbeat.yml file.

On two machines - one is Linux and the other Windows - when I update metricbeat and restart the process, the new indices it creates contain 5 shards and ignore the setting in the metricbeat.yml file. If I downgrade to the version I was using pre-update, it goes back to 1 shard. On the Linux box, the version that works correctly is 6.2.3 and on the Windows machine it's 6.1.2.

Am I missing obvious?

Thanks in advance!

[ruflin]

The number of indices depends on the template loaded. I wonder if for some reason there is an invalid template for 6.2.4 somewhere? Could you stop all beats, delete the metricbeat-6.2.4 template and start one beat again?

Also helpful would be if you could post the 6.2.4 template here before you delete it.

[robscott27]

It turns out that it sort of was something easy I was missing.

In my original metricbeat.yml file, I had setup.template.enabled set to false with my reasoning that it was setup and working (with 6.2.3) so it didn't need changing.

So I updated to 6.2.4, changed false to true, and restarted the process. Everything is fine now as it's taking 1 shard instead of 5. Then I updated metricbeat on the Windows machine and restarted the service; everything is fine there too.

Still not entirely sure why it would have gone with 5 shards if I had it set to only use one in the config file with the stipulation that the template not be over written. Or why after it was able to overwrite the template it started using the correct number of shards again.

Thanks for the help ruflin! You nudged me in the right direction with the templates.

[ruflin]

Glad you got it working.

If you disable the template, Metricbeat will not load a template an Elasticsearch will create it on the fly. The default by Elasticsearch for each index is 5. So in your case I assume the template was still loaded, but it will only apply to new indices. So the index that would have been created the next day would have been for 1 shard.