今天发现kibana的dashboard中没有filebeat收集的日志消息了,去看filebeat的服务发现并未停止,查看log后发现如下问题:Validation Failed: 1: this action would add [2] total shards, but this cluster currently has [1001]/[1000] maximum shards open。
排查后发现是es的分片数超出了数量,调大分片数
PUT /_cluster/settings
{
"transient": {
"cluster": {
"max_shards_per_node":10000
}
}
}