我正在运行Elastic stack
-我在systemctl status logstash.service -l
上收到错误消息:
"error"=>{"type"=>"illegal_argument_exception", "reason"=>"Limit of total fields [1000] in index [filebeat-2019.01.25] has been exceeded"}}}}
但是我这里没有为future
索引更改此选项,仅针对一个特定的。
我想知道如何为以后的所有指数更改此选项?
编辑:
我尝试添加新模板(如果有答案,我会在一段时间内看到):
curl -X PUT "localhost:9201/_template/filebeat" -H 'Content-Type: application/json' -d'
{
"index_patterns":[
"filebeat*"
],
"settings":{
"index":{
"codec":"best_compression",
"mapping":{
"total_fields":{
"limit":"10000"
}
}
}
}
}
'
现在我看到了:
sudo curl -X GET "localhost:9201/_template/filebeat*"
{"filebeat":{"order":0,"index_patterns":["filebeat*"],"settings":{"index":{"codec":"best_compression","mapping":{"total_fields":{"limit":"10000"}}}},"mappings":{},"aliases":{}}}