I observed these errors from the filebeat log.
2017-10-20T10:50:59-04:00 INFO Template already exists and will not be overwritten.
2017-10-20T10:50:59-04:00 ERR Failed to perform any bulk index operations: 429 Too Many Requests
2017-10-20T10:50:59-04:00 INFO Error publishing events (retrying): 429 Too Many Requests
Here is what I found from https://www.elastic.co/guide/en/elasticsearch/reference/5.6/tune-for-indexing-speed.html
"Make sure to watch for TOO_MANY_REQUESTS (429) response codes (EsRejectedExecutionException with the Java client), which is the way that Elasticsearch tells you that it cannot keep up with the current indexing rate. When it happens, you should pause indexing a bit before trying again, ideally with randomized exponential backoff."
how do I pause indexing with randomized exponential backoff?
Also from that elasticsearch page:
"The default index.refresh_interval is 1s, which forces Elasticsearch to create a new segment every second. Increasing this value (to say, 30s) will allow larger segments to flush and decreases future merge pressure"
Where can I set the " index.refresh_interval"