Lets say I wanted to just start again. Wipe out all my indices and let Logstash continue throwing data at ES and just accept my losses. How do I prevent this from happening in the future? From what I read, I'll need to specify the shard size in a template in LS. So am I right in thinking that I should design a template for every index? I assumed I should just use the one that Logstash chooses for me based on the content I throw at it. The only specific template I use is one I cobbled together for our Palo firewalls (shown below for ref). I guess I'm at a loss as to understand exactly how 3 nodes can't take the small amount of data I'm pushing at them. I've even reduced the curator cleanup to delete indices older than 7 days so with only 5 indices incoming and no more than 7 days of each of them.

Palo template

    {
      "template" : "palo-firewall-traffic*",
      "settings" : {
        "index.refresh_interval" : "5s"
      },
      "mappings" : {
        "_default_" : {
           "_all" : {"enabled" : true},
           "dynamic_templates" : [ {
             "message_field" : {
               "match" : "message",
               "match_mapping_type" : "string",
               "mapping" : {
                 "type" : "text", "norms" : false, "index" : true
               }
             }
           }, {
             "strings" : {
               "match" : "*",
               "match_mapping_type" : "string",
               "mapping" : {
                 "type" : "text", "norms" : false, "index" : true,
                   "fields" : {
                     "text" : {"type" : "keyword", "index" : true, "ignore_above" : 256}
                   }
               }
             }
           } ],
           "properties" : {
             "@version": { "type": "keyword", "index": true},
             "geoip"  : {
               "type" : "object",
                 "dynamic": true,
                 "properties" : {
                   "location" : { "type" : "geo_point" }
                 }
             },
             "SourceGeo"  : {
               "type" : "object",
                 "dynamic": true,
                 "properties" : {
                   "location" : { "type" : "geo_point" }
                 }
             },
             "DestinationGeo"  : {
               "type" : "object",
                 "dynamic": true,
                 "properties" : {
                   "location" : { "type" : "geo_point" }
                 }
             }
           }
        }
      }
    }

---