es7.6.2 Could not index event to Elasticsearch

报错如下

[2020-12-22T11:18:42,441][WARN ][logstash.outputs.elasticsearch][main] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"logstash-insurance-data-push-2020-12-22", :routing=>nil, :_type=>"_doc"}, #], :response=>{"index"=>{"_index"=>"logstash-insurance-data-push-2020-12-22", "_type"=>"_doc", "_id"=>nil, "status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"Validation Failed: 1: this action would add [10] total shards, but this cluster currently has [3000]/[3000] maximum shards open;"}}}}
{
           "level_value" => 20000,
                    "ip" => "10.5.235.137",
              "hostName" => "uatapipeline-data-push-job-profile-a-55b8c45df7-jv4qk",
           "contextName" => "data-push-job-uatapipeline-data-push-job-profile-a-55b8c45df7-jv4qk-6",
                  "tags" => [
        [0] "_jsonparsefailure"

Validation Failed: 1: this action would add [10] total shards, but this cluster currently has [3000]/[3000] maximum shards open

• 问题：
  分片数量超过限制数1000
• 原因：
  ELASTICSEARCH7版本及以上的，默认只允许1000个分片，因为集群分片数不足引起的。
• 解决：

在KIBANA的TOOLS中改变临时设，如图：

PUT /_cluster/settings
{
  "transient": {
    "cluster": {
      "max_shards_per_node":10000
    }
  }
}