For metrics and logging use cases you generally end up using time-based indices, which means that the shard count is almost always considerably larger than the number of cores on a server. As each shard comes with some overhead in terms of heap usage and file handles, having too many shards can also cause problems and be inefficient.