ELK logstash 翻转索引没有代表分片

Question

I use elk. And my logstash enabled rollover.index template 5 pri shards 1 rep shards. But only the current index has rep shards,old indexs only has pri shards. How to make old indexs also has 5 pri shards and 1 rep shards?

# GET /_cat/indices?v
health status index                               uuid                   pri rep docs.count docs.deleted store.size pri.store.size
green  open   cloud-logs-2022.03.02-000046        ycvYYKEtRZSJxR8wwdJlqQ   5   0  128888646            0     52.1gb         52.1gb
green  open   cloud-logs-2022.03.02-000047        JclF5gpoTxKvBpPuTuy-jQ   5   1   42849847            0     37.3gb         18.6gb

# GET /_template
{
"cloud-log": {
        "order": 1,
        "index_patterns": [
            "cloud-logs-*"
        ],
        "settings": {
            "index": {
                "lifecycle": {
                    "name": "logstash-policy",
                    "rollover_alias": "cloud-logs"
                },
                "codec": "best_compression",
                "mapping": {
                    "total_fields": {
                        "limit": "10000"
                    }
                },
                "refresh_interval": "30s",
                "number_of_shards": "5",
                "query": {},
                "number_of_routing_shards": "30",
                "number_of_replicas": "1"
            }
        },
        "mappings": {},
        "aliases": {}
    }
}

Answer 1

Your logstash-policy ILM policy that governs the lifecycle of your cloud-logs-* indexes probably states that when the index rolls over, the number of replica shards should be decreased from 1 to 0.

You can change that directly in Kibana > Stack management > Index lifecycle policy