报错如下
[2020-12-22T11:18:42,441][WARN ][logstash.outputs.elasticsearch][main] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"logstash-insurance-data-push-2020-12-22", :routing=>nil, :_type=>"_doc"}, #<LogStash::Event:0xe216446>], :response=>{"index"=>{"_index"=>"logstash-insurance-data-push-2020-12-22", "_type"=>"_doc", "_id"=>nil, "status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"Validation Failed: 1: this action would add [10] total shards, but this cluster currently has [3000]/[3000] maximum shards open;"}}}}{ "level_value" => 20000, "ip" => "10.5.235.137", "hostName" => "uatapipeline-data-push-job-profile-a-55b8c45df7-jv4qk", "contextName" => "data-push-job-uatapipeline-data-push-job-profile-a-55b8c45df7-jv4qk-6", "tags" => [ [0] "_jsonparsefailure"Validation Failed: 1: this action would add [10] total shards, but this cluster currently has [3000]/[3000] maximum shards open
- 问题：
分片数量超过限度数1000 - 起因：
ELASTICSEARCH7版本及以上的，默认只容许1000个分片，因为集群分片数有余引起的。 - 解决：
在KIBANA的TOOLS中扭转长期设，如图：
PUT /_cluster/settings{ "transient": { "cluster": { "max_shards_per_node":10000 } }}