enter code here
这是我收到的关于logstash运行状态的消息:
[logstash.outputs.elasticsearch][main][push to elasticsearch alerts index]无法将事件索引到elasticsearch。{:状态=>400,:操作=>[“索引”,{:\ id=>无10月9日12:42:43 elasticsearch日志存储[1064]:[2020-10-09t12:42:43467][警告]
logstash管道:
pipeline.id:main path.config:“/etc/logstash/conf.d/*.conf”
日志存储日志文件:
[1000]/[1000] maximum shards open;"}}}}
[2020-10-09T15:28:35,200][WARN ][logstash.outputs.elasticsearch][main][push to elasticsearch alerts
索引]无法将事件索引到elasticsearch。{:状态=>400,:操作=>[“索引”,{:_id=>nil,:_index=>“wazuh-alerts-3.x-2020.10.09”,:路由=>nil,:_type=>“_doc”},#日志存储::event:0x544ae594],:response=>{“index”=>{“\u index”=>“wazuh-alerts-3.x-2020.10.09”,“\u type”=>“\u doc”,“\u id”=>nil,“status”=>400,“error”=>{“type”=>“validation\u exception”,“reason”=>“验证失败:1:此操作将添加[1]个碎片总数,但此群集当前打开的碎片最多为[1000]/[1000];”}}
logstash conf文件
id => "push to elasticsearch alerts index"
hosts => ["http://xxx.189.196.214:9200"]
index => "wazuh-alerts-3.x-%{+YYYY.MM.dd}"
# ssl => true
# cacert => "/etc/logstash/logstash.crt"
# ssl_certificate_verification => false
# user => "logstash_writer"
# password => "pw"
}
}
else {
elasticsearch {
id => "push to elasticsearch archives index"
hosts => ["http://xxx.189.196.214:9200"]
index => "wazuh-archives-3.x-%{+YYYY.MM.dd}"
# ssl => true
# cacert => "/etc/logstash/logstash.crt"
# ssl_certificate_verification => false
# user => "logstash_writer"
# password => ""
}
}
}
curl -XGET 206.189.196.214:9200/_cluster/stats?filter_path=indices.shards.total
{"indices":{"shards":{"total":1000}}}
curl -XGET 206.189.196.214:9200/_cluster/alloca{
"error" : {
"root_cause" : [
{
"type" : "illegal_argument_exception",
"reason" : "unable to find any unassigned shards to explain [ClusterAllo
}
],
"type" : "illegal_argument_exception",
"reason" : "unable to find any unassigned shards to explain [ClusterAllocati
},
"status" : 400 curl -XGET 206.189.196.214:9200/ { "name" : "node-1", "cluster_name" : "elasticsearch", "cluster_uuid" :
“hgswrrdzr76gw2a6njjang”,“version”:{“number”:“7.9.2”,“build\u flavor”:“default”,“build\u type”:“deb”,“build\u hash”:“d34da0ea4a966c4e49417f2da2f244e3e97b4e6e”,“build\u date”:“2020-09-23t00:45:33.626720z”,“build\u snapshot”:false,“lucene\u version”:“8.6.2”,“minimum\u wire compatibility\u version”:“6.8.0”,“最小\u索引\u兼容性\u版本”:“6.0.0-beta1”},
curl -xget'http://206.189.196.214:9200/\u群集/运行状况?很好{
“cluster\u name”:“elasticsearch”,“status”:“green”,“timed\u out”:false,“节点数”:1,“数据节点数”:1,
“活动\u主\u碎片”:1000,“活动\u碎片”:1000,
“重新定位碎片”:0,“初始化碎片”:0,
“未分配的碎片”:0,“延迟的未分配的碎片”:0,
“挂起任务的数量”:0,“航班获取中的数量”:0,
“task\u max\u waiting\u in\u queue\u millis”:0,
“活动碎片百分比作为数字”:100.0
暂无答案!
目前还没有任何答案,快来回答吧!