关于elasticsearch:es762-Could-not-index-event-to-Elasticsearch

报错如下

[2020-12-22T11:18:42,441][WARN][logstash.outputs.elasticsearch][main] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"logstash-insurance-data-push-2020-12-22", :routing=>nil, :_type=>"_doc"}, #<LogStash::Event:0xe216446>], :response=>{"index"=>{"_index"=>"logstash-insurance-data-push-2020-12-22", "_type"=>"_doc", "_id"=>nil, "status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"Validation Failed: 1: this action would add [10] total shards, but this cluster currently has [3000]/[3000] maximum shards open;"}}}}
{
           "level_value" => 20000,
                    "ip" => "10.5.235.137",
              "hostName" => "uatapipeline-data-push-job-profile-a-55b8c45df7-jv4qk",
           "contextName" => "data-push-job-uatapipeline-data-push-job-profile-a-55b8c45df7-jv4qk-6",
                  "tags" => [[0] "_jsonparsefailure"

Validation Failed: 1: this action would add [10] total shards, but this cluster currently has [3000]/[3000] maximum shards open

• 问题：
  分片数量超过限度数 1000
• 起因：
  ELASTICSEARCH7 版本及以上的，默认只容许 1000 个分片，因为集群分片数有余引起的。
• 解决：

在 KIBANA 的 TOOLS 中扭转长期设，如图：

PUT /_cluster/settings
{
  "transient": {
    "cluster": {"max_shards_per_node":10000}
  }
}