Question

我正在使用带有elestic搜索和kibana的logstash来挖掘我的日志。它工作正常，直到昨天，但突然开始给出以下错误，我无法理解 -

No results There were no results because no indices were found that match your selected time span

logstash日志包含以下信息

    {:timestamp=>"2013-12-19T17:32:47.612000+0530", :message=>"Using milestone 2 input plugin 'file'. This plugin should be stable, but if you see strange behavior, please let us know! For more inform$
{:timestamp=>"2013-12-19T17:32:47.728000+0530", :message=>"You are using a deprecated config setting \"type\" set in multiline. Deprecated settings will continue to work, but are scheduled for rem$
{:timestamp=>"2013-12-19T17:32:47.781000+0530", :message=>"You are using a deprecated config setting \"type\" set in grok. Deprecated settings will continue to work, but are scheduled for removal $
{:timestamp=>"2013-12-19T17:32:47.839000+0530", :message=>"You are using a deprecated config setting \"type\" set in date. Deprecated settings will continue to work, but are scheduled for removal $
Exception in thread "LogStash::Runner" org.jruby.exceptions.RaiseException: (EADDRINUSE) Address already in use - bind - Address already in use
        at org.jruby.ext.socket.RubyTCPServer.initialize(org/jruby/ext/socket/RubyTCPServer.java:118)
        at org.jruby.RubyIO.new(org/jruby/RubyIO.java:852)
        at RUBY.initialize(jar:file:/u001/logparser/tools/logstash/logstash-1.3.1-flatjar.jar!/ftw/server.rb:50)
        at org.jruby.RubyArray.each(org/jruby/RubyArray.java:1613)
        at RUBY.initialize(jar:file:/u001/logparser/tools/logstash/logstash-1.3.1-flatjar.jar!/ftw/server.rb:46)
        at org.jruby.RubyArray.each(org/jruby/RubyArray.java:1613)
        at RUBY.initialize(jar:file:/u001/logparser/tools/logstash/logstash-1.3.1-flatjar.jar!/ftw/server.rb:34)
        at RUBY.run(file:/u001/logparser/tools/logstash/logstash-1.3.1-flatjar.jar!/rack/handler/ftw.rb:94)
        at RUBY.run(file:/u001/logparser/tools/logstash/logstash-1.3.1-flatjar.jar!/logstash/kibana.rb:101)

Answer 1

来到logstash响应：您要通过logstash保存数据的elasticsearch路径索引一直拒绝接收数据。由于一次又一次地反复敲击同一个查询，它使得java应用程序在同一时刻点击同一个端口。因此，它停止了logstash应用程序并显示绑定问题。

来到kibana回应：检查elasticsearch中的映射和索引名称和模式，它试图保存数据和kibana试图获取数据

如果您在弹性搜索中安装了头部插件，则可以看到索引启动弹性搜索服务

bin/elasticsearch -f 然后从浏览器

http://elasticsearchinstalledip:9201/_plugin/head

LogStash：kibana警报 - 无结果没有结果，因为找不到与您选择的时间跨度匹配的索引

1 个答案: