ELK LATEST - illegal_argument_exception during loading template manually

Elastic Stack Beats
1

Hi Team,

I am getting error while configuring filebeat:
{"error":{"root_cause":[{"type":"remote_transport_exception","reason":"[servername][ESIP:9300][indices:admin/template/put]"}],"type":"illegal_argument_exception","reason":"the number of source shards [9] must be a must be a factor of [30]"},"status":400}

I've created a ELK cluster on Ubuntu. Currently trying to configure filebeat to send data to Logstash. Below is what i have done so far:

  1. Installed latest Filebeat on app system (suse)

  2. Installed the syslog module (not using currently)

  3. Configured filebeat the yml:
    #==================== Elasticsearch template setting ==========================

setup.template.settings:
index.number_of_shards: 9
_source.enabled: false
index.number_of_replicas: 2
#index.codec: best_compression
#_source.enabled: false

#================================ General =====================================

#----------------------------- Logstash output --------------------------------
output.logstash:
##The Logstash hosts
hosts: ["LOGSTASH_IP:5044"]

  1. I have disabled Elastic search and kibana parts.
  2. I did below steps as per guide

    filebeat export template > filebeat.template.json
    curl -XPUT -H 'Content-Type: application/json' http://ES_IP:9200/_template/filebeat-6.1.2 -d@filebeat.template.json

The curl command is giving me the error i mentioned before.

Can you please help ?

2

I assume you are running ES/filebeat 6.2 or master?

See the description from this PR: https://github.com/elastic/beats/pull/5570

I think you need to set index.number_of_routing_shards: 36 or some other multiple of 9.

3

Hi Tudor,

Thanks a lot. I did some checks and seems this is related to split indexes. My use case does not require split indexes, can i disable it somehow ?

Best Regards,
Kris

4

I didn't test it, but I think setting index.number_of_routing_shards: 0 should work.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.