# Please help - ES 2.1.1 cluster randomly crashing

**URL:** <https://discuss.elastic.co/t/please-help-es-2-1-1-cluster-randomly-crashing/38861>\
**Category:** Elasticsearch\
**Created:** [January 11, 2016, 10:02am UTC](https://discuss.elastic.co/t/please-help-es-2-1-1-cluster-randomly-crashing/38861 "2016-01-11T10:02:55Z")\
**Posts on this page:** 1\
**Showing post:** 12

<div class="post-metadata">

**Author:** ![plonka2000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/plonka2000/32/5077_2.png) [@plonka2000](https://discuss.elastic.co/u/plonka2000)\
**Post date:** [January 14, 2016, 10:47am UTC](https://discuss.elastic.co/t/please-help-es-2-1-1-cluster-randomly-crashing/38861/12 "2016-01-14T10:47:15Z")

</div>

@dadoonet @Christian_Dahlqvist  
This is a fairly out-of-box installation, so I have not been manually administering the shards, they may have simply grown out of control for some reason.

I'm going to investigate how to limit shards, but I would appreciate if you had any advice on config settings related to this.

Thanks.

**EDIT:** I found the `index.number_of_shards` setting, I will be rebuilding with this set to `1` in the `elasticsearch.yml` file. Found the details [here](https://www.elastic.co/guide/en/elasticsearch/reference/2.1/index-modules.html#index-modules-settings).

(For anyone else wondering about this, the default is set to `5`, so if there are 131 indicies, replicated to a single mirror node, that would explain why there are 1302 shards. The last 2 are `.kibana`, I think.)  
==\> _`131x5x2=1310`_

**EDIT2:** I'm going to reduce the shard count primarily by setting the `index.number_of_shards` setting to `1`, but in addition, I'm going to investigate using less indices, as recommended by @dadoonet and @Christian_Dahlqvist.  
This second part I think I need to do on the Logstash side, by setting the `index` setting in my output config, as according to [this docs page](https://www.elastic.co/guide/en/logstash/2.0/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-index) , it defaults to `"logstash-%{+YYYY.MM.dd}"`, creating an index for each day as standard.  
I think setting this to a definite single index such as `"logstash-someindexname"`, would allow me to leave the `index.number_of_shards` at the unconfigured default of `5`.

---

_[View the full topic](https://discuss.elastic.co/t/please-help-es-2-1-1-cluster-randomly-crashing/38861)._