Filebeat-7.6.0问题:
--使用默认模板创建索引时,正常
--使用自定义模板创建索引时,启动filebeat后,报错如下:
ERROR pipeline/output.go:121 Failed to publish events: temporary bulk send failure
暂时没有找到解决办法。(官网和github上没有找到有效的解决办法)
附自定义索引配置文件:
--使用默认模板创建索引时,正常
--使用自定义模板创建索引时,启动filebeat后,报错如下:
ERROR pipeline/output.go:121 Failed to publish events: temporary bulk send failure
暂时没有找到解决办法。(官网和github上没有找到有效的解决办法)
附自定义索引配置文件:
filebeat.inputs:
- type: log
enabled: true
paths:
- /data/logs/ptomweb/*.log
fields:
source: ptomweblog
fields_under_root: true
tail_files: true
#filebeat.config.modules:
# path: ${path.config}/modules.d/*.yml
# reload.enabled: true
setup.template.settings:
index.number_of_shards: 1
setup.template.name: "java"
setup.template.pattern: "java-*"
setup.template.overwrite: true
setup.template.enabled: true
setup.ilm.enabled: false
output.elasticsearch:
hosts: ["http://192.168.0.xx:9200"]
username: "elastic"
password: "xxx"
index: "java-%{[fields.source]}-*"
indices:
- index: "java-ptomweblog-%{+yyyy.MM.dd}"
when.equals:
fields.source: "ptomweblog"
setup.kibana:
host: "192.168.0.xx:5601"
username: "elastic"
password: "xxxx"
processors:
- drop_fields:
fields: ["agent.ephemeral_id", "agent.hostname", "agent.id", "agent.version", "ecs.version", "log.offset", "agent.type", "input.type"]
ignore_missing: true
2 个回复
zqc0512 - andy zhou
赞同来自:
shuchen
赞同来自:
或者setup.template.overwrite: true setup.template.enabled: true这两个去掉看下。