ELK LATEST - illegal_argument_exception during loading template manually

[Krishna_Sharma]

Hi Team,

I am getting error while configuring filebeat:
{"error":{"root_cause":[{"type":"remote_transport_exception","reason":"[servername][ESIP:9300][indices:admin/template/put]"}],"type":"illegal_argument_exception","reason":"the number of source shards [9] must be a must be a factor of [30]"},"status":400}

I've created a ELK cluster on Ubuntu. Currently trying to configure filebeat to send data to Logstash. Below is what i have done so far:

1. Installed latest Filebeat on app system (suse)

2. Installed the syslog module (not using currently)

3. Configured filebeat the yml:
   #==================== Elasticsearch template setting ==========================

setup.template.settings:
index.number_of_shards: 9
_source.enabled: false
index.number_of_replicas: 2
#index.codec: best_compression
#_source.enabled: false

#================================ General =====================================

#----------------------------- Logstash output --------------------------------
output.logstash:
##The Logstash hosts
hosts: ["LOGSTASH_IP:5044"]

4. I have disabled Elastic search and kibana parts.
5. I did below steps as per guide

   filebeat export template > filebeat.template.json
   curl -XPUT -H 'Content-Type: application/json' http://ES_IP:9200/_template/filebeat-6.1.2 -d@filebeat.template.json

The curl command is giving me the error i mentioned before.

Can you please help ?

[tudor (Tudor Golubenco)]

I assume you are running ES/filebeat 6.2 or master?

See the description from this PR: https://github.com/elastic/beats/pull/5570

I think you need to set index.number_of_routing_shards: 36 or some other multiple of 9.

[Krishna_Sharma]

Hi Tudor,

Thanks a lot. I did some checks and seems this is related to split indexes. My use case does not require split indexes, can i disable it somehow ?

Best Regards,
Kris

[tudor (Tudor Golubenco)]

I didn't test it, but I think setting index.number_of_routing_shards: 0 should work.