Logstash报错: Could not index event to Elasticsearch
一、环境说明
Logstash 7.3
ElasticSearch 7.3
二、现象
logstash/logs/logstash-plain.log大量警告:
Validation Faile
d: 1: this action would add [1] total shards, but this cluster currently has [1000]/[1000] maximum shards op
en;
三、原因
elasticsearch7版本及以上的,默认只允许1000个分片,因为集群分片数不足引起的。
四、解决
4.1 临时解决方案(重启ES将失效)
在kibana -> 开发者工具 -> Console页签下执行如DSL下语句
PUT /_cluster/settings
{
"transient": {
"cluster": {
"max_shards_per_node":10000
}
}
1
2
3
4
5
6
7
8
4.2 永久解决方案
在kibana -> 开发者工具 -> Console页签下执行如DSL下语句
PUT /_cluster/settings
{
"persistent": {
"cluster": {
"max_shards_per_node":10000
}
}
————————————————
版权声明:本文为CSDN博主「懵懂无知的蜗牛」的原创文章,遵循CC 4.0 BY-SA版权协议,转载请附上原文出处链接及本声明。
原文链接:https://blog.csdn.net/qq_25646191/article/details/111860572
- Elasticsearch Logstash Could index eventelasticsearch logstash could index elasticsearch logstash kibana平台 elasticsearch logstash windows kibana elasticsearch宝库logstash文件 elasticsearch aggregation问题could elasticsearch logstash大小 内存 elasticsearch logstash kibana stack elasticsearch logstash数据docker elasticsearch modules index elasticsearch logstash kibana系统