elasticsearch Filebeat日志中的错误-无法查看kibana中的数据

niknxzdl  于 2023-01-08  发布在  ElasticSearch
关注(0)|答案(1)|浏览(336)

最近升级到7.17.7 filebeat。使用elasticsearch,kibana和filebeat,所有7.17.7。但是,我不能看到kibana的日志,因为filebeat没有发送日志到elasticsearch和kibana。在filebeat看到错误-

ERROR   [publisher_pipeline_output]     pipeline/output.go:154  Failed to connect to backoff(elasticsearch(http://localhost:9200)): Connection marked as failed because the onConnect callback failed: resource 'filebeat-7.17.7' exists, but it is not an alias

有人能帮助找出这个错误的原因和解决方案吗?
重新启动filebeat,但没有帮助。
文件节拍配置-

filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /var/www/vhosts/rshop/current/var/log/*.log
  multiline.pattern: ^\[[0-9]{4}-[0-9]{2}-[0-9]{2}
  multiline.negate: true
  multiline.match: after
filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false
setup.template.settings:
  index.number_of_shards: 3
setup.ilm.enabled: false
setup.kibana:
output.elasticsearch:
  hosts: ["localhost:9200"]
  indices:
    - index: "r-logs-%{[agent.version]}-%{+yyyy.MM.dd}"
      when.regexp:
        log.file.path: '^.+\/var\/log\/recalculation\.log$'
  pipelines:
    - pipeline: "filebeat-6.8.7-monolog-pipeline"
      when.or:
        - regexp:
            log.file.path: '^.+\/var\/log\/recalculation\.log$' 
processors:
  - add_host_metadata: ~
  - add_cloud_metadata: ~
logging.level: info
logging.to_files: true
logging.files:
  path: /var/log/filebeat
  name: filebeat
  keepfiles: 7
  permissions: 0755
e4eetjau

e4eetjau1#

@NKumar很可能是从旧的索引模板升级到新的索引模板的问题,如果您不将它们标记为真以进行覆盖,就会发生这种情况。
您能否提供从哪个版本的堆栈升级到7.17的信息?
此外,快速的解决方案是将别名添加到filebeat索引中,如下所示:

POST /_aliases
{
  "actions" : [
{
  "add" : {
    "index" : "filebeat-7.17.7",
    "alias" : "filebeat-7.17.7_1",
    "is_write_index" : true
  }
}
]}

或者更持久的解决方案是在filebeat中添加以下设置:

setup.template.settings:
  setup.template.enabled: true
  setup.template.overwrite: true

相关问题