Why is elasticsearch not displaying incoming information?

Question

elasticsearch

We have assembled an elasticsearch server for ourselves, Apache logs are sent there. At one point, he simply stopped issuing new data. There is plenty of disk space, elasticsearch maintains servers from which data is sent. The following error began to appear in the logstahs logs:
Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"billing.dostek.kg_access-2019.08.02", :_type=>"_doc", :routing= >nil}, #], :response=>{"index"=>{"_index"=>"index_of_sent_log", "_type"=>"_doc", "_id"=>nil, "status"=>400, "error"=>{"type"=>"validation_exception", "reason"=>"Validation Failed: 1: this action would add [2] total shards,

Answer 1

ES 7.0 introduced a soft limit ( cluster.max_shards_per_node = 1000) for the number of shards per node. Either increase the value (one and a half thousand shards with small indexes were pulled by the server with -Xmx 5G), or delete / collapse the existing indexes by the number of shards, or add nodes.