Set replica shard to default 0

Elastic Stack Elasticsearch
1

Is there any way to set the replica shard such that it will always be 0 when a new index is created?

The default that I am getting now is that logstash output will result the 5 primary and 5 replica shards in my 2 nodes. I want 5 primary shard only and have it spread across the two nodes.

I am doing so to save disk usage.

2

You can set the default number of shards and replicas for new indexes via elasticsearch.yml. You can also, which I recommend, use index templates to accomplish the same thing.

You should probably reduce the number of shards too. If you have daily rolling indexes you don't need five shards if you have a two-node cluster.

3

Due to limited hardware I am now running 2 nodes. I intend to put in more more nodes in the future. My index size ranges from 1 to 2 GB. This is why I am using the default 5 shard config so that if it grows in the future I can still support a maximum of 5 GB per index.

4

Agreeing that index templates is the better way to do this. It'll be more flexible, and you can tweak it over time without restarting the nodes. You can basically setup a catchall pattern that matches all new indices:

PUT /_template/everything_template
{
  "template": "*",
  "settings": {
    "number_of_replicas": 0
  }
}

Index template docs here: https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-templates.html