I'm running a test environment with one node only with elasticsearch and generating indexes with the patern prefix-[type]-yyyy.mm.dd.
Information is generated in logfiles, that are sent with filebeat to logstash to process.
There are different values for [type] so each day i get several indexes.
Todavy i realized that i did not have any information in elasticsearch since yerterday, and looking in logstash logfiles i realized when it send the information to elasticsearch, the later had found max number of shards and where not able to create a new shard.
Then i increased the value of
cluster.max_shards_per_node and new information coming from filebeat got indexed, however the logs that failed to be indexed during the night where not indexed.
Isnt it supposed that logstash retry if it cannot reach the output? or as in this case the output was reachable but elasticsearch returned error then logstash does not try to index the information again?