查看logstash的日志报错如下：tail -f logstash-plain.log
"error"=>{"type"=>"validation_exception", "reason"=>"Validation Failed: 1: this action would add [2] shards, but this cluster currently has [999]/[1000] maximum normal shards open;"}
二、修改参数，增大分片最大数量进入kibana，进入开发工具进行修改，persistent 是永久修改，如果只是临时修改，用 transient 替换 persistent ，
PUT _cluster/settings
{
"persistent": {
"cluster": {
"max_shards_per_node":20000
}
}
}
如果是elasticsearch配置修改，在配置文件中增加以下参数配置：
cluster.max_shards_per_node: 20000
