现象:lostack启动正常,logstack收集输入redis数据,输出到elasticsearch写入失败
提示:去建索引 的时候elasticsearch返回404
[2019-11-12T11:37:29,009][WARN ][logstash.outputs.elasticsearch][main] Could not index event to Elasticsearch. {:status=>404, :action=>["index", {:_id=>nil, :_index=>"nginx-172.16.2.13-2019.11.12", :_type=>"doc", :_routing=>nil}, #<LogStash::Event:0x26f38258>], :response=>{"index"=>{"_index"=>"nginx-172.16.2.13-2019.11.12", "_type"=>"doc", "_id"=>nil, "status"=>404, "error"=>{"type"=>"index_not_found_exception", "reason"=>"no such index", "resource.type"=>"index_expression", "resource.id"=>"nginx-172.16.2.13-2019.11.12", "index_uuid"=>"_na_", "index"=>"nginx-172.16.2.13-2019.11.12"}}}}
解决方法:
因elasticsearch配置问题导致,action.auto_create_index: false #禁用自动创建index
将false改成true即可,或者删除这个配置,查阅官方文档改配置是默认开启的。
希望能帮你解决。