# Could not index event to Elasticsearch: Maximum shards open **URL:** \ **Category:** Elasticsearch\ **Created:** [August 22, 2019, 8:26pm UTC](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-maximum-shards-open/196402 "2019-08-22T20:26:52Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Don\_Withanage](https://avatars.discourse-cdn.com/v4/letter/d/9fc348/32.png) [@Don\_Withanage](https://discuss.elastic.co/u/Don_Withanage)\ **Post date:** [August 22, 2019, 8:26pm UTC](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-maximum-shards-open/196402/1 "2019-08-22T20:26:53Z")
I am creating indexes on Elasticsearch daily from metricbeat, auditbeat, winlogbeat, and other logs. I have run into the issue of getting an error on the logstash saying "Validation Failed: this action would add [2] total shards, but this cluster currently has [999]/[1000] maximum shards open". Here is a more detailed log of the error: ``` Aug 22 13:01:24 elastic7-logstash logstash[980]: [2019-08-22T13:01:24,828][WARN][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"winlogbeat-7.3.0-2019.08.22", :_type=>"_doc", :routing=>nil}, #], :response=>{"index"=>{"_index"=>"winlogbeat-7.3.0-2019.08.22", "_type"=>"_doc", "_id"=>nil, "status"=>400, "error"=>{"type"=>"validation_exception", "reason"=>"Validation Failed: 1: this action would add [2] total shards, but this cluster currently has [999]/[1000] maximum shards open;"}}}} Aug 22 13:01:24 elastic7-logstash logstash[980]: [2019-08-22T13:01:24,828][WARN][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"winlogbeat-7.3.0-2019.08.22", :_type=>"_doc", :routing=>nil}, #], :response=>{"index"=>{"_index"=>"winlogbeat-7.3.0-2019.08.22", "_type"=>"_doc", "_id"=>nil, "status"=>400, "error"=>{"type"=>"validation_exception", "reason"=>"Validation Failed: 1: this action would add [2] total shards, but this cluster currently has [999]/[1000] maximum shards open;"}}}} Aug 22 13:01:24 elastic7-logstash logstash[980]: [2019-08-22T13:01:24,828][WARN][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"winlogbeat-7.3.0-2019.08.22", :_type=>"_doc", :routing=>nil}, #], :response=>{"index"=>{"_index"=>"winlogbeat-7.3.0-2019.08.22", "_type"=>"_doc", "_id"=>nil, "status"=>400, "error"=>{"type"=>"validation_exception", "reason"=>"Validation Failed: 1: this action would add [2] total shards, but this cluster currently has [999]/[1000] maximum shards open;"}}}} Aug 22 13:01:24 elastic7-logstash logstash[980]: [2019-08-22T13:01:24,828][WARN][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"winlogbeat-7.3.0-2019.08.22", :_type=>"_doc", :routing=>nil}, #], :response=>{"index"=>{"_index"=>"winlogbeat-7.3.0-2019.08.22", "_type"=>"_doc", "_id"=>nil, "status"=>400, "error"=>{"type"=>"validation_exception", "reason"=>"Validation Failed: 1: this action would add [2] total shards, but this cluster currently has [999]/[1000] maximum shards open;"}}}} Aug 22 13:01:24 elastic7-logstash logstash[980]: [2019-08-22T13:01:24,829][WARN][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"winlogbeat-7.3.0-2019.08.22", :_type=>"_doc", :routing=>nil}, #], :response=>{"index"=>{"_index"=>"winlogbeat-7.3.0-2019.08.22", "_type"=>"_doc", "_id"=>nil, "status"=>400, "error"=>{"type"=>"validation_exception", "reason"=>"Validation Failed: 1: this action would add [2] total shards, but this cluster currently has [999]/[1000] maximum shards open;"}}}} Aug 22 13:01:24 elastic7-logstash logstash[980]: [2019-08-22T13:01:24,829][WARN][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"winlogbeat-7.3.0-2019.08.22", :_type=>"_doc", :routing=>nil}, #], :response=>{"index"=>{"_index"=>"winlogbeat-7.3.0-2019.08.22", "_type"=>"_doc", "_id"=>nil, "status"=>400, "error"=>{"type"=>"validation_exception", "reason"=>"Validation Failed: 1: this action would add [2] total shards, but this cluster currently has [999]/[1000] maximum shards open;"}}}} Aug 22 13:01:24 elastic7-logstash logstash[980]: [2019-08-22T13:01:24,829][WARN][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"winlogbeat-7.3.0-2019.08.22", :_type=>"_doc", :routing=>nil}, #], :response=>{"index"=>{"_index"=>"winlogbeat-7.3.0-2019.08.22", "_type"=>"_doc", "_id"=>nil, "status"=>400, "error"=>{"type"=>"validation_exception", "reason"=>"Validation Failed: 1: this action would add [2] total shards, but this cluster currently has [999]/[1000] maximum shards open;"}}}} ``` On Kibana: When I run the command:`GET _cat/health?v` It gives me the following output: ``` epoch timestamp cluster status node.total node.data shards pri relo init unassign pending_tasks max_task_wait_time active_shards_percent 1566505132 20:18:52 dev-cluster yellow 1 1 520 520 0 0 511 9 1.1s 50.4% ``` Currently, I have 504 indices open. If I close the indexes, it helps me to recover from this issue temporally. Until more indexes are created and reach the limit. Can you help me fix this issue? Thank you! ---
**Author:** ![linkerc](https://avatars.discourse-cdn.com/v4/letter/l/13edae/32.png) [@linkerc](https://discuss.elastic.co/u/linkerc)\ **Post date:** [August 22, 2019, 10:08pm UTC](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-maximum-shards-open/196402/2 "2019-08-22T22:08:03Z")
> [@Don\_Withanage](#): > > GET \_cat/health?v You only have 1 data node. So you can only have 1 shard and no replica for such cluster to be green, which is not good. I believe all the unassigned shards are because there are no additional data nodes to assign to. It should've been a day one issue. You need at least 2 data nodes to allow 1 replica so primary & replica shards are on 2 different nodes. ---
**Author:** ![wangqinghuan](https://avatars.discourse-cdn.com/v4/letter/w/d26b3c/32.png) [@wangqinghuan](https://discuss.elastic.co/u/wangqinghuan)\ **Post date:** [August 23, 2019, 1:18am UTC](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-maximum-shards-open/196402/3 "2019-08-23T01:18:23Z")
You are reaching the limit 'cluster.max\_shards\_per\_node'. Add more data node or reduce your shards of cluster. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 20, 2019, 1:18am UTC](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-maximum-shards-open/196402/4 "2019-09-20T01:18:36Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.