Shards failed caused by index.max_docvalue_fields_search

I have a problem with filebeat indexes , a new index is made everyday and each time I get a shard failed error. The reason behind it is shown as the index.max_docvalue_fields_search is too low.
I run this in dev tools every time I see a shard failed error.

PUT /filebeat-*/_settings
  "index.max_docvalue_fields_search": 200

I also added this is filebeat.yml

    max_docvalue_fields_search: 200

There has been no difference. Is there any way I can fix this error, I have checked the index patterns and there is no mapping issue. any help would be great

You might need to directly update the filebeat index template. Am not sure changing this in Filebeat will cause it to be updated.

you mean by re-indexing or the actual template through stack management ?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.