用logstash收集日志,kafka作为输入,队列中有16-20号的日志,启动后20号的数据建的索引是好的,前几天的数据建的索引是red的,没有匹配到我的自定义模板,分片数默认的而且是未分配的,导致整个集群是red的,求大神看看是为什么
如图
配置i部分:
input {
kafka {
zk_connect => "xxx:2181"
topic_id => "trace_debug"
reset_beginning => true
consumer_threads => 5
decorate_events => false
}
}
output {
elasticsearch {
action => "index"
hosts => ["xxx"]
index => "gateway-logs-%{+YYYY.MM.dd}"
document_type => "gateway-logs"
template => "/opt/logstash-2.3.4/bin/gateway-logs.json"
template_name => "gateway-logs"
template_overwrite => true
}
}
如图
配置i部分:
input {
kafka {
zk_connect => "xxx:2181"
topic_id => "trace_debug"
reset_beginning => true
consumer_threads => 5
decorate_events => false
}
}
output {
elasticsearch {
action => "index"
hosts => ["xxx"]
index => "gateway-logs-%{+YYYY.MM.dd}"
document_type => "gateway-logs"
template => "/opt/logstash-2.3.4/bin/gateway-logs.json"
template_name => "gateway-logs"
template_overwrite => true
}
}
1 个回复
wangnan9279
赞同来自: