Before upgrading to 7.5 our single node elasticsearch ran fine with the default value of 1000 max shards. Now we're having serious problems due to the shard count steadily climbing (it's floating around 3600 now). Is there a piece of the upgrade documentation I missed? Nothing in our templates changed.
What new indices are being created?
Are indices using beat version in the name? If so, are you creating many different version for each beat (filebeat, winlogbeat etc)
How many shards do each new index have?
Are you aging off old indices?
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.