最近升级到7.17.7 filebeat。使用elasticsearch,kibana和filebeat,所有7.17.7。但是,我不能看到kibana的日志,因为filebeat没有发送日志到elasticsearch和kibana。在filebeat看到错误-
ERROR [publisher_pipeline_output] pipeline/output.go:154 Failed to connect to backoff(elasticsearch(http://localhost:9200)): Connection marked as failed because the onConnect callback failed: resource 'filebeat-7.17.7' exists, but it is not an alias
有人能帮助找出这个错误的原因和解决方案吗?
重新启动filebeat,但没有帮助。
文件节拍配置-
filebeat.inputs:
- type: log
enabled: true
paths:
- /var/www/vhosts/rshop/current/var/log/*.log
multiline.pattern: ^\[[0-9]{4}-[0-9]{2}-[0-9]{2}
multiline.negate: true
multiline.match: after
filebeat.config.modules:
path: ${path.config}/modules.d/*.yml
reload.enabled: false
setup.template.settings:
index.number_of_shards: 3
setup.ilm.enabled: false
setup.kibana:
output.elasticsearch:
hosts: ["localhost:9200"]
indices:
- index: "r-logs-%{[agent.version]}-%{+yyyy.MM.dd}"
when.regexp:
log.file.path: '^.+\/var\/log\/recalculation\.log$'
pipelines:
- pipeline: "filebeat-6.8.7-monolog-pipeline"
when.or:
- regexp:
log.file.path: '^.+\/var\/log\/recalculation\.log$'
processors:
- add_host_metadata: ~
- add_cloud_metadata: ~
logging.level: info
logging.to_files: true
logging.files:
path: /var/log/filebeat
name: filebeat
keepfiles: 7
permissions: 0755
1条答案
按热度按时间e4eetjau1#
@NKumar很可能是从旧的索引模板升级到新的索引模板的问题,如果您不将它们标记为真以进行覆盖,就会发生这种情况。
您能否提供从哪个版本的堆栈升级到7.17的信息?
此外,快速的解决方案是将别名添加到filebeat索引中,如下所示:
或者更持久的解决方案是在filebeat中添加以下设置: