日志是從logstash傳輸給ES的,但是logstash配置中只能配置host和index,所以只能在es中進行配置
但是在es配置文件中配置,也就是新增如下參數的話會報錯:node settings must not contain any index level settings
index.number_of_shards: 1
index.number_of_replicas: 0
所以采用索引模板的方式進行設置
POST /_templates/index_patterns
{
"order": 0,
"index_patterns": [
"filebeat_*"
],
"settings": {
"index": {
"number_of_shards": "1",
"number_of_replicas": "0"
}
},
"mappings": {},
"aliases": {}
}
凡是索引名是filebeat_*
的,分片數是1 ,副本數是0