Question

Elastic正在Azure中的Windows Server 2012 R2 VM上运行。 VM1：在我的工作站上使用Windows Server 2012 R2在Hyper-V中运行。没有代理人 VM2：使用Windows Server 2012 R2在受保护域中进行安装;需要代理

我的Logstash配置（my.config）具有以下输出定义：

elasticsearch 
{ 
    host => "myhost.cloudapp.net"
    cluster => "mycluster"
    document_type => "%{type}"
    index => "%{index}_%{+YYYY.MM.dd}"
    template_name => "%{index}"
    document_id => "%{id}"
    protocol => "http"
}

VM1可以将数据加载到弹性搜索主机中我从VM1压缩了logstash文件夹并将其复制到VM2中并将其解压缩。然后我创建了一个放在\ logstash \ bin

中的start.bat文件

cls
SET JAVA_HOME=D:\JDK
SET LS_JAVA_OPTS=-Dhttp.proxyHost=myproxy.mydomain.com -Dhttp.proxyPort=8080
logstash.bat agent -f my.conf

在VM2上运行时，在命令提示符窗口中生成以下内容：

io/console not supported; tty will not be manipulated
Failed to install template: connect timed out {:level=>:error}
Logstash startup completed
Got error to send bulk of actions: connect timed out {:level=>:error}
Failed to flush outgoing items {:outgoing_count=>1, :exception=>#<Manticore::Timeout: connect timed out>, 
:backtrace=>["D:/LogStash/vendor/bundle/jruby/1.9/gems/manticore-0.4.1-java/lib/manticore/response.rb:35:in `initialize'", 
"org/jruby/RubyProc.java:271:in `call'", 
"D:/LogStash/vendor/bundle/jruby/1.9/gems/manticore-0.4.1-java/lib/manticore/response.rb:61:in `call'", 
"D:/LogStash/vendor/bundle/jruby/1.9/gems/manticore-0.4.1-java/lib/manticore/response.rb:225:in `call_once'", 
"D:/LogStash/vendor/bundle/jruby/1.9/gems/manticore-0.4.1-java/lib/manticore/response.rb:128:in `code'", 
"D:/LogStash/vendor/bundle/jruby/1.9/gems/elasticsearch-transport-1.0.12/lib/elasticsearch/transport/transport/http/manticore.rb:71:in `perform_request'", 
"org/jruby/RubyProc.java:271:in `call'", 
"D:/LogStash/vendor/bundle/jruby/1.9/gems/elasticsearch-transport-1.0.12/lib/elasticsearch/transport/transport/base.rb:190:in `perform_request'", 
"D:/LogStash/vendor/bundle/jruby/1.9/gems/elasticsearch-transport-1.0.12/lib/elasticsearch/transport/transport/http/manticore.rb:54:in `perform_request'", 
"D:/LogStash/vendor/bundle/jruby/1.9/gems/elasticsearch-transport-1.0.12/lib/elasticsearch/transport/client.rb:119:in `perform_request'", 
"D:/LogStash/vendor/bundle/jruby/1.9/gems/elasticsearch-api-1.0.12/lib/elasticsearch/api/actions/bulk.rb:80:in `bulk'", 
"D:/LogStash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-1.0.1-java/lib/logstash/outputs/elasticsearch/protocol.rb:103:in `bulk'", 
"D:/LogStash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-1.0.1-java/lib/logstash/outputs/elasticsearch.rb:505:in `submit'", 
"D:/LogStash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-1.0.1-java/lib/logstash/outputs/elasticsearch.rb:529:in `flush'", 
"D:/LogStash/vendor/bundle/jruby/1.9/gems/stud-0.0.20/lib/stud/buffer.rb:219:in `buffer_flush'", 
"org/jruby/RubyHash.java:1341:in `each'", 
"D:/LogStash/vendor/bundle/jruby/1.9/gems/stud-0.0.20/lib/stud/buffer.rb:216:in `buffer_flush'", 
"D:/LogStash/vendor/bundle/jruby/1.9/gems/stud-0.0.20/lib/stud/buffer.rb:112:in `buffer_initialize'", 
"org/jruby/RubyKernel.java:1511:in `loop'", 
"D:/LogStash/vendor/bundle/jruby/1.9/gems/stud-0.0.20/lib/stud/buffer.rb:110:in `buffer_initialize'"], :level=>:warn}

我用Logstash v1.5.0尝试过这个。我将VM2中的logstash版本更新为v1.5.2，但这似乎没有帮助。

我进入“配置Java”GUI并在网络设置下设置代理，但没有帮助。我也使用JDK版本1.8.0_45-b15。

我也试过使用http输出插件，这也没用。这是logstash配置：

 http
 {
      http_method => "post"
      url => "http://myhost.cloudapp.net/myindex/mytype"
 }

我得到的错误是（仅复制下面的异常消息）。

:response=>nil, :exception=>#<Errno::EBADF: Bad file descriptor - Bad file descriptor>

值得一提的是，我可以使用Mozilla和Internet Explorer访问Marvel Sense插件，并可以向Elastic Search集群发出请求。这是来自fiddler的示例请求标头：

GET http://myhost.cloudapp.net:9200/_cat/indices?_=1436330129174 HTTP/1.1
Referer: http://myhost.cloudapp.net:9200/_plugin/marvel/sense/index.html
Accept: text/plain, */*; q=0.01
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; rv:11.0) like Gecko
Host: xirtes.cloudapp.net:9200
Proxy-Connection: Keep-Alive

非常感谢任何帮助。

Answer 1

尝试：
输出{ elasticsearch { index =＆gt; “％{索引} _％{+} YYYY.MM.DD” host =＆gt; “myhost.cloudapp.net” port =＆gt; “9200” protocol =＆gt; HTTP idle_flush_time =＆gt; 1 flush_size =＆gt; 5000 } }

Answer 2

与弹性搜索中的善良人员交谈并确认LogStash目前不支持转发代理。但是，已发出新请求以添加此功能（https://github.com/logstash-plugins/logstash-output-elasticsearch/issues/199）

他们建议在此期间使用反向代理（如果可能的话）。

尝试配置Logstash以使用具有LS_JAVA_OPTS的代理，但它似乎不起作用

2 个答案: