Modify default number of Elasticsearch shards

That is right changing index.number_of_shards defaults in config file would involve changing the setting on all nodes and then restarting the instance ideally following the guidelines for rolling restarts.

However if that is not an option and if explicitly specifying the number_of_shards in the settings while creating the new index is not ideal then the workaround would be using index templates

Example:

One can create an index_defaults default as below

PUT /_template/index_defaults 
{
  "template": "*", 
  "settings": {
    "number_of_shards": 4
  }
}

This applies the setting specified in index_defaults template to all new indexes.

Once you set the number of shards for an index in ElasticSearch, you cannot change them. You will need to create a new index with the desired number of shards, and depending on your use case, you may want then to transfer the data to the new index.

I say depending on the use case because, for instance, if you are storing time based data such as log events, it is perfectly reasonable to close one index and open a new one with a different number of shards, and index all data going forward to that new index, keeping the old one for searches.

However, if your use case is, for instance, storing blog documents, and your indices are by topic, then you will need to (a) create new indices as stated above with a different number of shards and (b) reindex your data. For (b) I recommend using the Scroll and Scan API to get the data out of the old index.

You need to create a template for new indices that will be created:

PUT /_template/index_defaults 
{
    "index_patterns": "*", 
    "settings" : {
        "index" : {
            "number_of_shards" : 1,
            "number_of_replicas" : 1
        }
    }
}

For old indices you need to reindex.

Example: from my_old_index to my_new_index

Create the new index with appropriate mapping and settings:

PUT my_new_index
{
    "settings" : {
        "index" : {
            "number_of_shards" : 1,
            "number_of_replicas" : 1
        }
    }
}

Reindex from old index to new one, specify type only if you desire:

POST /_reindex?slices=5
{
    "size": 100000,
    "source": { "index": "my_old_index" },
    "dest": { "index": "my_new_index", "type": "my_type" }
}