---
title: Shard Too Large
description: Describes what AutoOps detects and surfaces with the Shard Too Large insight: One or more shards exceed recommended size limits (roughly 50 GB or very high document counts).
url: https://docs-v3-preview.elastic.dev/elastic/autoops-insights/tree/main/elasticsearch/shard_too_large
products:
  - Elastic Cloud Enterprise
  - Elastic Cloud Hosted
  - Elastic Cloud on Kubernetes
  - Elasticsearch
applies_to:
  - Elastic Cloud Hosted: Generally available
  - Elastic Cloud on Kubernetes: Generally available
  - Elastic Cloud Enterprise: Generally available
  - Self-managed Elastic deployments: Generally available
---

# Shard Too Large
One or more shards exceed recommended size limits (roughly 50 GB or very high document counts). Oversized shards slow recovery, relocation, and search, and in extreme cases can become hard to move or write.
<note>
  For a complete list of insights, refer to [AutoOps insights](https://docs-v3-preview.elastic.dev/elastic/autoops-insights/tree/main/elasticsearch).
</note>


## Insight details


| Field     | Value                                           |
|-----------|-------------------------------------------------|
| Component | Elasticsearch                                   |
| Severity  | Medium                                          |
| Scope     | Index                                           |
| Domains   | performance, index-management, shard-allocation |


## Customization settings

You can customize these settings to adjust when AutoOps detects this event and presents the insight. Refer to [AutoOps event settings](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/deploy-manage/monitor/autoops/ec-autoops-event-settings) for details.
The default customization settings are:

| Setting                               | Type            | Default |
|---------------------------------------|-----------------|---------|
| Maximum optimal shard size in GB      | Integer         | 0.0004  |
| Exclude indices based on this pattern | List of strings |         |


## Example: What you might see in AutoOps

The following is an example of what you might see when this insight is triggered. Real insights use live data and links from your deployment or cluster.

### There are large shards in the cluster


#### What was detected

Total number of indices with large shards: 12 The index that contains the largest shard is: logs-prod-000045, and the shard size is: 42,000,000. See a sample list: `logs-prod-000045`, `logs-prod-000046`.

#### Recommendations

<note>
  AutoOps shows different recommendations depending on how their conditions match your deployment or cluster.
</note>

<dropdown title="ILM policy for large shards">
  **Condition**: Always shown for this insight.If logs-prod-000045 is time-based, set or tune its ILM policy so rollover targets roughly 20–30 GB shards.
</dropdown>

<dropdown title="Reindex into smaller indices">
  **Condition**: Shown when for non-system indexes.Reindex into smaller indices to reduce shard sizes and improve search performance.
</dropdown>

<dropdown title="Split index into more shards">
  **Condition**: Shown when primary shard count is less than data node count and shard size warrants split.Use the Split API to split logs-prod-000045 (current size logs-prod-000045) into 2 primary shards with the action below. Run during low cluster load and confirm you have enough disk space. See the [Split index API](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-indices-split) for prerequisites.
  ```json

  {
    "settings": {
      "index.number_of_shards": 2
    }
  }
  ```

  <note>
    Requires the `manage cluster` privilege. Requires Elasticsearch 8.0.0 or later. This action changes cluster or index configuration.
  </note>
</dropdown>

<dropdown title="Delete old data">
  **Condition**: Shown when !!!.Delete unused or old indices to free disk space. Snapshot indices first if you might need them later. Use the action below to remove logs-archive-000001.
  ```json
  ```

  <note>
    Requires the `manage cluster` privilege. Requires Elasticsearch 8.0.0 or later. This action changes cluster or index configuration.
  </note>
</dropdown>


#### Background and impact

Impact: Large shards can cause slow searches and decrease cluster performance. A shard that greatly exceeds the recommended limit of 50GB or that contains more than 2B documents might become corrupted or unwritable. Index data is partitioned into shards, and the number of shards in an index depends on the index settings used when the index was originally created. It is recommended not to surpass 50GB for a single shard and to try not to store more than 200M documents per shard. Beyond this size your shard might become unwritable, or cluster might be cannot relocate or recover index shards.