Code review comment for ~hloeung/charm-graylog:master

> I worry about what happens if the shard count changes, and if users need to be
> warned. Or maybe graylog and/or elasticsearch doesn't suck and things get
> rebalanced magically.

Nothing happens to the existing data when shards are changed, even if you reduce the number of shards. It only applies to new index sets (either automatically rotated out as configured or manually via the UI/API).

So let's say you have 5 indices already and the index set was previously set to 4 shards. You add more elasticsearch units and bump the index set to 6, the 5 old indices will remain as is sharded across 4 (instead of 6). Elasticsearch will most likely relocate the shards or replicas to the new elasticsearch units but that's it.

Same goes for if you're removing and reducing down to say 3 elasticsearch units. Old indicies will still be sharded across 4 with Elasticsearch automatically relocating shards/replicas:

0 1 2 (unit)
1 2 3 (shards)
4 (shards)

With automatic index shards set, it can also take a while to apply because there's no way that I know of to detect additional elasticsearch unit changes unless something is done to the elasticsearch relation to pass that back.