# ELK LATEST - illegal\_argument\_exception during loading template manually

**URL:** <https://discuss.elastic.co/t/elk-latest-illegal-argument-exception-during-loading-template-manually/116724>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [January 23, 2018, 6:05pm UTC](https://discuss.elastic.co/t/elk-latest-illegal-argument-exception-during-loading-template-manually/116724 "2018-01-23T18:05:18Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Krishna\_Sharma](https://avatars.discourse-cdn.com/v4/letter/k/fbc32d/32.png) [@Krishna\_Sharma](https://discuss.elastic.co/u/Krishna_Sharma)\
**Post date:** [January 23, 2018, 6:05pm UTC](https://discuss.elastic.co/t/elk-latest-illegal-argument-exception-during-loading-template-manually/116724/1 "2018-01-23T18:05:18Z")

</div>

Hi Team,

I am getting error while configuring filebeat:  
{"error":{"root\_cause":[{"type":"remote\_transport\_exception","reason":"[servername][ESIP:9300][indices:admin/template/put]"}],"type":"illegal\_argument\_exception","reason":"the number of source shards [9] must be a must be a factor of [30]"},"status":400}

I've created a ELK cluster on Ubuntu. Currently trying to configure filebeat to send data to Logstash. Below is what i have done so far:

1. Installed latest Filebeat on app system (suse)

2. Installed the syslog module (not using currently)

3. Configured filebeat the yml:  
#==================== Elasticsearch template setting ==========================

setup.template.settings:  
index.number\_of\_shards: 9  
\_source.enabled: false  
index.number\_of\_replicas: 2  
#index.codec: best\_compression  
#\_source.enabled: false

#================================ General =====================================

#----------------------------- Logstash output --------------------------------  
output.logstash:  
##The Logstash hosts  
hosts: ["LOGSTASH\_IP:5044"]

1. I have disabled Elastic search and kibana parts.
2. I did below steps as per guide

> > filebeat export template \> filebeat.template.json  
> > curl -XPUT -H 'Content-Type: application/json' http://ES\_IP:9200/\_template/filebeat-6.1.2 -d@filebeat.template.json

The curl command is giving me the error i mentioned before.

Can you please help ?

---

<div class="post-metadata">

**Author:** ![tudor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tudor/32/3753_2.png) [@tudor](https://discuss.elastic.co/u/tudor)\
**Post date:** [January 23, 2018, 8:53pm UTC](https://discuss.elastic.co/t/elk-latest-illegal-argument-exception-during-loading-template-manually/116724/2 "2018-01-23T20:53:26Z")

</div>

I assume you are running ES/filebeat 6.2 or master?

See the description from this PR: [https://github.com/elastic/beats/pull/5570](https://github.com/elastic/beats/pull/5570)

I think you need to set `index.number_of_routing_shards: 36` or some other multiple of 9.

---

<div class="post-metadata">

**Author:** ![Krishna\_Sharma](https://avatars.discourse-cdn.com/v4/letter/k/fbc32d/32.png) [@Krishna\_Sharma](https://discuss.elastic.co/u/Krishna_Sharma)\
**Post date:** [January 24, 2018, 4:00am UTC](https://discuss.elastic.co/t/elk-latest-illegal-argument-exception-during-loading-template-manually/116724/3 "2018-01-24T04:00:42Z")

</div>

Hi Tudor,

Thanks a lot. I did some checks and seems this is related to split indexes. My use case does not require split indexes, can i disable it somehow ?

Best Regards,  
Kris

---

<div class="post-metadata">

**Author:** ![tudor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tudor/32/3753_2.png) [@tudor](https://discuss.elastic.co/u/tudor)\
**Post date:** [January 24, 2018, 9:46am UTC](https://discuss.elastic.co/t/elk-latest-illegal-argument-exception-during-loading-template-manually/116724/4 "2018-01-24T09:46:53Z")

</div>

I didn't test it, but I think setting `index.number_of_routing_shards: 0` should work.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 21, 2018, 9:47am UTC](https://discuss.elastic.co/t/elk-latest-illegal-argument-exception-during-loading-template-manually/116724/5 "2018-02-21T09:47:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.