Max Documents Per Shard
One or more shards are approaching the practical maximum document count per shard (about 200 million documents). Uneven growth can come from parent/child or nested routing, too few primary shards, or missing rollover for time-series indices.
For a complete list of insights, refer to AutoOps insights.
| Field | Value |
|---|---|
| Component | Elasticsearch |
| Severity | High |
| Scope | Index |
| Domains | disk-storage, index-management |
You can customize these settings to adjust when AutoOps detects this event and presents the insight. Refer to AutoOps event settings for details.
The default customization settings are:
| Setting | Type | Default |
|---|---|---|
| Exclude indices based on this pattern | List of strings |
The following is an example of what you might see when this insight is triggered. Real insights use live data and links from your deployment or cluster.
More than 25 indices with shards approaching the maximum number of documents were found. The index that contains the most documents in a single shard is logs-prod-000045 with 42,000,000 documents. Other sampled indices approaching the maximum document limit: logs-prod-000045, logs-prod-000046.
AutoOps shows different recommendations depending on how their conditions match your deployment or cluster.
Split index into more shards
Condition: Shown when primary shard count is less than data node count.
Use the Split API to split logs-prod-000045 (current size logs-prod-000045) into 2 primary shards with the action below. Run during low cluster load and confirm you have enough disk space. See the Split index API for prerequisites.
POST logs-prod-000045/_split/logs-prod-000045-0001
{
"settings": {
"index.number_of_shards": 2
}
}
Requires the manage cluster privilege. Requires Elasticsearch 8.0.0 or later. This action changes cluster or index configuration.
Rollover indices
Condition: Shown when for time-series indices approaching document limit.
If logs-prod-000045 are time-based, roll them over and set 2 primary shards on the new write index so you can avoid a heavy segment merge on the current indices.
Reindex into smaller indices
Condition: Shown when primary shard count is less than data node count.
Reindex into smaller indices to reduce shard sizes and improve search performance.
Split index into more shards
Condition: Shown when shard document count approaches limit and split is viable.
Use the Split API to split logs-prod-000045 into a new index with more primary shards. Its largest shard currently holds 0 documents.
Shards in indexes 12 are approaching the maximum recommended number of documents allowed for a single shard (200,000,000). This can happen in unbalanced scenarios with parent/child relationships and nested documents, as child documents are routed to the same shard as the parent document. For all other cases, this can happen because the index does not have enough shards or, for time series data, the index needs to be rolled over.