常见错误

validation Failed: 1: this action would add [2] total shards, but this cluster currently has [999]/[1000] maximum shards open;

注意：下面max_shards_per_node参数设置方法适用于elasticsearch7和elasticsearch8。

https://blog.csdn.net/u011250186/article/details/139882388

默认elasticsearch最大的分片数只有1000，并且已经占用了999片，但是此时elasticsearch创建新索引时还需要2个分片。也就是说elasticsearch的分片数不够用了。

查看当前默认最大分片数默认为1000

# 使用kibana查询
GET _cluster/settings?include_defaults=true

# 查询max_shards_per_node值默认为1000

编辑/usr/share/elasticsearch/config/elasticsearch.yml配置文件增加max_shards_per_node值为2000

cluster.name: "docker-cluster"
network.host: 0.0.0.0
cluster.max_shards_per_node: 2000

再次通过kibana查看配置此时max_shards_per_node值变为2000

GET _cluster/settings?include_defaults=true

详细设置请参考https://gitee.com/dexterleslie/demonstration/tree/master/elasticsearch/elasticsearch7

访问kibana时，提示"Data too large, data for [<http_request>] would be ..."错误

错误信息如下：

{"statusCode":500,"error":"Internal Server Error","message":"[parent] Data too large, data for [<http_request>] would be [514390462/490.5mb], which is larger than the limit of [510027366/486.3mb], real usage: [514389880/490.5mb], new bytes reserved: [582/582b], usages [request=0/0b, fielddata=0/0b, in_flight_requests=582/582b, model_inference=0/0b, eql_sequence=0/0b, accounting=10639028/10.1mb]: [circuit_breaking_exception] [parent] Data too large, data for [<http_request>] would be [514390462/490.5mb], which is larger than the limit of [510027366/486.3mb], real usage: [514389880/490.5mb], new bytes reserved: [582/582b], usages [request=0/0b, fielddata=0/0b, in_flight_requests=582/582b, model_inference=0/0b, eql_sequence=0/0b, accounting=10639028/10.1mb], with { bytes_wanted=514390462 & bytes_limit=510027366 & durability=\"PERMANENT\" }"}

经过分析，是GC回收后都无法释放elasticsearch jvm内存导致，解决办法：调整elasticsearch内存为-Xmx1024m或者更高值