无法将事件索引到elasticsearch status=400,action=index,id=nil

z31licg0  于 2021-06-14  发布在  ElasticSearch
关注(0)|答案(0)|浏览(593)

enter code here 这是我收到的关于logstash运行状态的消息:
[logstash.outputs.elasticsearch][main][push to elasticsearch alerts index]无法将事件索引到elasticsearch。{:状态=>400,:操作=>[“索引”,{:\ id=>无10月9日12:42:43 elasticsearch日志存储[1064]:[2020-10-09t12:42:43467][警告]
logstash管道:
pipeline.id:main path.config:“/etc/logstash/conf.d/*.conf”
日志存储日志文件:

[1000]/[1000] maximum shards open;"}}}}
[2020-10-09T15:28:35,200][WARN ][logstash.outputs.elasticsearch][main][push to elasticsearch alerts

索引]无法将事件索引到elasticsearch。{:状态=>400,:操作=>[“索引”,{:_id=>nil,:_index=>“wazuh-alerts-3.x-2020.10.09”,:路由=>nil,:_type=>“_doc”},#日志存储::event:0x544ae594],:response=>{“index”=>{“\u index”=>“wazuh-alerts-3.x-2020.10.09”,“\u type”=>“\u doc”,“\u id”=>nil,“status”=>400,“error”=>{“type”=>“validation\u exception”,“reason”=>“验证失败:1:此操作将添加[1]个碎片总数,但此群集当前打开的碎片最多为[1000]/[1000];”}}
logstash conf文件

id => "push to elasticsearch alerts index"
        hosts => ["http://xxx.189.196.214:9200"]
        index => "wazuh-alerts-3.x-%{+YYYY.MM.dd}"

# ssl => true

# cacert => "/etc/logstash/logstash.crt"

# ssl_certificate_verification => false

# user => "logstash_writer"

# password => "pw"

      }
   }
   else {
      elasticsearch {
        id => "push to elasticsearch archives index"
        hosts => ["http://xxx.189.196.214:9200"]
        index => "wazuh-archives-3.x-%{+YYYY.MM.dd}"

# ssl => true

# cacert => "/etc/logstash/logstash.crt"

# ssl_certificate_verification => false

# user => "logstash_writer"

# password => ""

      }
   }
}

 curl -XGET 206.189.196.214:9200/_cluster/stats?filter_path=indices.shards.total
{"indices":{"shards":{"total":1000}}}

curl -XGET 206.189.196.214:9200/_cluster/alloca{
  "error" : {
    "root_cause" : [
      {
        "type" : "illegal_argument_exception",
        "reason" : "unable to find any unassigned shards to explain [ClusterAllo
      }
    ],
    "type" : "illegal_argument_exception",
    "reason" : "unable to find any unassigned shards to explain [ClusterAllocati
  },
  "status" : 400  curl -XGET 206.189.196.214:9200/ {   "name" : "node-1",   "cluster_name" : "elasticsearch",   "cluster_uuid" :

“hgswrrdzr76gw2a6njjang”,“version”:{“number”:“7.9.2”,“build\u flavor”:“default”,“build\u type”:“deb”,“build\u hash”:“d34da0ea4a966c4e49417f2da2f244e3e97b4e6e”,“build\u date”:“2020-09-23t00:45:33.626720z”,“build\u snapshot”:false,“lucene\u version”:“8.6.2”,“minimum\u wire compatibility\u version”:“6.8.0”,“最小\u索引\u兼容性\u版本”:“6.0.0-beta1”},
curl -xget'http://206.189.196.214:9200/\u群集/运行状况?很好{
“cluster\u name”:“elasticsearch”,“status”:“green”,“timed\u out”:false,“节点数”:1,“数据节点数”:1,
“活动\u主\u碎片”:1000,“活动\u碎片”:1000,
“重新定位碎片”:0,“初始化碎片”:0,
“未分配的碎片”:0,“延迟的未分配的碎片”:0,
“挂起任务的数量”:0,“航班获取中的数量”:0,
“task\u max\u waiting\u in\u queue\u millis”:0,
“活动碎片百分比作为数字”:100.0

暂无答案!

目前还没有任何答案,快来回答吧!

相关问题