Thanks for you guys’ pointer.
- I am able to run following command to change the replica from 0 to 1
curl -XPUT -d '{"number_of_replicas": "1"}' http://mysyslog01:9200/graylog_4*/_settings
- I can see the replica(yellow) got created in Elasticsearch head’s web GUI.

- After sync , sized doubled from 8/9 to 16/17GB.
curl -XGET 'mysyslog02:9200/_cat/indices?v&pretty'
health status index uuid pri rep docs.count <cut> store.size pri.store.size
green open graylog_425 QhH-masked 4 1 43231571 <cut> 17.5gb 8.7gb
green open graylog_420 7WlAmasked 4 1 43745655 <cut> 17.2gb 8.6gb
green open graylog_418 mOTQmasked 4 1 43885335 <cut> 17.3gb 8.6gb
green open graylog_422 oJ8Xmasked 4 1 48102521 <cut> 19gb 9.5gb
green open graylog_419 hs3Emasked 4 1 44658968 <cut> 17.5gb 8.7gb
green open graylog_421 1XLVmasked 4 1 42517082 <cut> 16.7gb 8.3gb
green open graylog_426 tMpHmasked 4 1 37226193 <cut> 16.6gb 8.3gb
green open graylog_427 rDJ0masked 4 1 30389074 <cut> 14.5gb 7.3gb
green open .kibana XReomasked 1 1 3 <cut> 24.8kb 12.4kb
green open graylog_424 3Yy_masked 4 1 45254311 <cut> 17.9gb 8.9gb
green open graylog_423 -KOJmasked 4 1 49306494 <cut> 19.4gb 9.7gb
- Question is what do I do with repica=0 setting in /etc/graylog/server/server.conf
[root@syslog01 server]# egrep -v '^#|^$' /etc/graylog/server/server.conf |grep replica
elasticsearch_replicas = 0
[root@syslog01 server]#