logstash报错如下：Validation Failed: 1: this action would add [2] total shards, but this cluster currently has [999]/[1000] maximum shards open

超过最大分片引起的，在es机器上执行：curl -XPUT -H "Content-Type:application/json" -d '{"persistent":{"cluster":{"max_shards_per_node":10000}}}' 'http://es-host:9200/_cluster/settings'

参见elasticsearch之修改shards数_11944248的技术博客_51CTO博客