@dadoonet @Christian_Dahlqvist
This is a fairly out-of-box installation, so I have not been manually administering the shards, they may have simply grown out of control for some reason.
I'm going to investigate how to limit shards, but I would appreciate if you had any advice on config settings related to this.
Thanks.
EDIT: I found the index.number_of_shards setting, I will be rebuilding with this set to 1 in the elasticsearch.yml file. Found the details here.
(For anyone else wondering about this, the default is set to 5, so if there are 131 indicies, replicated to a single mirror node, that would explain why there are 1302 shards. The last 2 are .kibana, I think.)
==> 131x5x2=1310
EDIT2: I'm going to reduce the shard count primarily by setting the index.number_of_shards setting to 1, but in addition, I'm going to investigate using less indices, as recommended by @dadoonet and @Christian_Dahlqvist.
This second part I think I need to do on the Logstash side, by setting the index setting in my output config, as according to this docs page , it defaults to "logstash-%{+YYYY.MM.dd}", creating an index for each day as standard.
I think setting this to a definite single index such as "logstash-someindexname", would allow me to leave the index.number_of_shards at the unconfigured default of 5.