# Could not index event to Elasticsearch..cluster currently has \[1000\]/\[1000\] maximum shards open

**URL:** https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-cluster-currently-has-1000-1000-maximum-shards-open/246620
**Category:** Elasticsearch
**Created:** [August 27, 2020, 12:52pm UTC](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-cluster-currently-has-1000-1000-maximum-shards-open/246620 "2020-08-27T12:52:53Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![ksaha](https://avatars.discourse-cdn.com/v4/letter/k/b782af/32.png) [@ksaha](https://discuss.elastic.co/u/ksaha)
#### Post date: [August 27, 2020, 12:52pm UTC](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-cluster-currently-has-1000-1000-maximum-shards-open/246620/1 "2020-08-27T12:52:53Z")

</div>

Hi,  
I have an Elasticsearch cluster with single node. Metricbeat and Filebeat are creating daily new index. The ELK Stack have been working properly from last few months. But from today I am getting the below error:

```auto
[2020-08-27T10:48:17,387][WARN][logstash.outputs.elasticsearch][metricbeat] Could not index event to Elasticsearch. {:status=>400, :action=>["in>nil, :_index=>"postgresql-2020.08.27", :routing=>nil, :_type=>"_doc"}, #<LogStash::Event:0x7ba78919>], :response=>{"index"=>{"_index"=>"postgres7", "_type"=>"_doc", "_id"=>nil, "status"=>400, "error"=>{"type"=>"validation_exception", "reason"=>"Validation Failed: 1: this action would add ards, but this cluster currently has [1000]/[1000] maximum shards open;"}}}}

```

I have gone through other questions asked on the same issue, the suggested solution was to increase the number of data node. But in my case as of now I can't increase number of data node. What can I do to solve this issue? (In my case, every index has single primary shard).

Any help will be appreciated.  
Thanks

---

<div class="post-metadata">

### Author: ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [August 27, 2020, 12:59pm UTC](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-cluster-currently-has-1000-1000-maximum-shards-open/246620/2 "2020-08-27T12:59:45Z")

</div>

If you have a long retention period, switch to weekly or monthly indices. Otherwise consolidate indices and/or reduce the retention period.

---

<div class="post-metadata">

### Author: ![ksaha](https://avatars.discourse-cdn.com/v4/letter/k/b782af/32.png) [@ksaha](https://discuss.elastic.co/u/ksaha)
#### Post date: [August 27, 2020, 1:16pm UTC](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-cluster-currently-has-1000-1000-maximum-shards-open/246620/3 "2020-08-27T13:16:21Z")

</div>

Thanks @Christian_Dahlqvist for your reply.  
As of now it is urgent to solve this issue. I think to modify the retention period in ILM policy will take some time for me as I am new in ELK stack. Can you please tell or provide some resource on how to consolidate old indexes ? How many index I can consolidate together or is there any size limit in the consolidation of old indexes into a big index?

Thanks.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 24, 2020, 1:16pm UTC](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-cluster-currently-has-1000-1000-maximum-shards-open/246620/4 "2020-09-24T13:16:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.