If I understood correctly, setting
index.number_of_shards = 2
(instead of 1) would create a second shard for the large index, splitting it into two shards? This
seems to say that it’s not possible to change this value after the index creation, is it true?
Well, as long as you're using a single node, it should indeed alleviate the shard disk size limit, but I'm not sure ES will handle that too well. In any case, you can't change that for existing indices, you can modify the mapping template and reindex the existing index (you'll need to index to another name, delete the original and create an alias to the original name as the new index can't be renamed...)
Also what is the benefit of having by default
index.number_of_shards = 1
for the metrics and the logs indices? Having more allows to scale and later move them in separate nodes if needed - the default heap size being 2Gb, it should be possible, or?
Well, as long as you use a single node, multiple shards offer no scale improvement