Shard allocation for logstash