I want to do the on the fly template overwrite for 1 of my index data (basically is to decrease the shards count). so i need to add below session:
my questions is do I need to add this to all the logstash indexer's conf which output to same index or only need to add into one? my thought is add into one should be enough because once the template is overwritten (by either of the indexer), the rest of indexer will use the new template already. Please correct me if I am wrong.
output {
elasticsearch {
hosts => ["fslelkprod01","fslelkprod02","fslelkprod03"]
index => "amhstrending-%{+YYYY.MM.dd}"
template => "/etc/logstash/template/amhstrending_template.json"
template_overwrite => true
}
}