Question

我在Debian上使用ES 1.4.4和LS 1.5以及Kibana 4。我开始logstash，它工作几分钟然后我有一个致命的错误。为了关闭logstash，我必须删除存储在ES中的最新数据，这是我找到的唯一方法。一个更相关的事实是Elastic Search看起来没问题，我可以看到kibana中的旧数据和插件头工作正常。我的输出配置：输出{elasticsearch {port =＆gt; 9200协议=＆gt; http host =＆gt; “127.0.0.1”}}

任何帮助将不胜感激：）

以下是完整的错误消息：在127.0.0.1向弹性搜索服务器发送大量操作时出错：读取超时时间{：level =＆gt;：error}

无法刷新传出的项目{：outgoing_count =＆gt; 1362，：exception =＆gt;＃，：backtrace =＆gt; [“/ opt / logstash / vendor / bundle / jruby / 1.9 / gems / manticore-0.3.5 -java / lib / manticore / response.rb：35：在initialize'“，”org / jruby / RubyProc.java：271：incall'“，”/ opt / logstash / vendor / bundle / jruby / 1.9 / gems / syntaxore -0.3.5-java / lib / manticore / response.rb:61:in call'“，”/ opt / logstash / savend / bundle / jruby / 1.9 / gems / culturalore-0.3.5-java/lib/manticore/ response.rb：224：incall_once'“，”/ opt / logstash / vendor / bundle / jruby / 1.9 / gems / culturalore-0.3.5-java/lib/manticore/response.rb:127:in code'“，” /opt/logstash/vendor/bundle/jruby/1.9/gems/elasticsearch-transport-1.0.7/lib/elasticsearch/transport/transport/http/manticore.rb:50:inperform_request'“，”org / jruby / RubyProc。 java：271：in call'“，”/ opt / logstash / vendor / bundle / jruby / 1.9 / gems / elasticsearch-transport-1.0.7 / lib / elasticsearch / transport / transport / base.rb：187：inperform_request'“ ，“/opt/logstash/vendor/bundle/jruby/1.9/gems/elasticsearch-transport-1.0.7/lib/elasticsearch/tra nsport / transport / http / manticore.rb：33：在perform_request'“，”/ opt / logstash / vendor / bundle / jruby / 1.9 / gems / elasticsearch-transport-1.0.7 / lib / elasticsearch / transport / client.rb ：115：inperform_request'“，”/ opt / logstash / vendor / bundle / jruby / 1.9 / gems / elasticsearch-api-1.0.7 / lib / elasticsearch / api /actions / bulk.rb：80：in bulk'“， “/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.1.18-java/lib/logstash/outputs/elasticsearch/protocol.rb:82:inbulk'”，“/ opt / logstash / vendor / bundle / jruby / 1.9 / gems / logstash-output-elasticsearch-0.1.18-java / lib / logstash / outputs / elasticsearch.rb：413：in submit'“，”/ opt / logstash / vendor / bundle /jruby/1.9/gems/logstash-output-elasticsearch-0.1.18-java/lib/logstash/outputs/elasticsearch.rb:412:insubmit'“，”/ opt / logstash / vendor / bundle / jruby / 1.9 / gems /logstash-output-elasticsearch-0.1.18-java/lib/logstash/outputs/elasticsearch.rb:438:in flush'“，”/ opt / logstash / vendor / bundle / jruby / 1.9 / gems / logstash-output- elasticsearch-0.1.18-java的/ LIB / logstash /输出/ elasticse arch.rb：436：inflush'“，”/ opt / logstash / vendor / bundle / jruby / 1.9 / gems / stud0.0.1.1 / lib / stud / bump.rb：219：in buffer_flush'“，”org / jruby / RubyHash.java:1341：ineach'“，”/ opt / logstash / vendor / bundle / jruby / 1.9 / gems / stud0.0.1.1 / lib /stud / bump.rb：216：in buffer_flush'“，” /opt/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.19/lib/stud/buffer.rb:193:inbuffer_flush'“，”/ opt / logstash / vendor / bundle / jruby / 1.9 / gems /stud-0.0.19/lib/stud/buffer.rb:159:in buffer_receive'“，”/ opt / logstash / vendor / bundle / jruby / 1.9 / gems / logstash-output-elasticsearch-0.1.18-java / lib / logstash / outputs / elasticsearch.rb：402：inreceive'“，”/ opt / logstash / lib / logstash / output / base.rb：88：in handle'“，”（eval）：1070：ininitialize'“， “org / jruby / RubyArray.java：1613：in each'”，“org / jruby / RubyEnumerable.java：805：inflat_map'”，“（eval）：1067：in initialize'”，org / jruby / RubyProc。 java：271：incall'“，”/ opt / logstash / lib / logstash / pipeline.rb：279：输出'“，”/ opt / logstash / lib / logstash / pipeline.rb：235：inoutputworker'“，” /选择/ logstash / lib中/ logstash / pipelin e.rb：163：在'start_outputs'“]中，：level =＆gt;：warn}

Answer 1

您的弹性搜索已超过存储空间，无法编写来自logstash的新文档，尝试删除旧索引然后

PUT your_index/_settings
{
  "index": {
  "blocks.read_only": false
  }
}

我希望这对你有用。谢谢!!

使用ElasticSearch输出时的Logstash错误消息=＆gt;“无法刷新传出的项目”

1 个答案: