Tune StackLight for long-term log retention

Available since 2.24.0 and 2.24.2 for MOSK 23.2

If you plan to switch to a long log retention period (months), tune StackLight by increasing the cluster.max_shards_per_node limit. This configuration enables OpenSearch to successfully accept new logs and prevents the maximum open shards error.

To tune StackLight for long-term log retention:

  1. Increase the cluster.max_shards_per_node limit:

    logging:
      extraConfig:
        cluster.max_shards_per_node: 10000
    
  2. If you increase the limit to more than double the default value, increase the memory and CPU limit for opensearch to prevent MaxHeapUsage warnings.

    For example, if you set cluster.max_shards_per_node: 20000, configure the resources:opensearch:limits section as follows:

    resources:
      opensearch:
        limits:
          cpu: "8"
          memory: "45Gi"