报错如下
[2020-12-22T11:18:42,441][WARN][logstash.outputs.elasticsearch][main] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"logstash-insurance-data-push-2020-12-22", :routing=>nil, :_type=>"_doc"}, #<LogStash::Event:0xe216446>], :response=>{"index"=>{"_index"=>"logstash-insurance-data-push-2020-12-22", "_type"=>"_doc", "_id"=>nil, "status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"Validation Failed: 1: this action would add [10] total shards, but this cluster currently has [3000]/[3000] maximum shards open;"}}}}
{
"level_value" => 20000,
"ip" => "10.5.235.137",
"hostName" => "uatapipeline-data-push-job-profile-a-55b8c45df7-jv4qk",
"contextName" => "data-push-job-uatapipeline-data-push-job-profile-a-55b8c45df7-jv4qk-6",
"tags" => [[0] "_jsonparsefailure"
Validation Failed: 1: this action would add [10] total shards, but this cluster currently has [3000]/[3000] maximum shards open
- 问题：
分片数量超过限度数 1000 - 起因：
ELASTICSEARCH7 版本及以上的，默认只容许 1000 个分片，因为集群分片数有余引起的。 - 解决：
在 KIBANA 的 TOOLS 中扭转长期设，如图：
PUT /_cluster/settings
{
"transient": {
"cluster": {"max_shards_per_node":10000}
}
}