Logstash在群集期间关闭

Question

我在第一个elasticsearch/logstash/kibana节点中配置了集群，并在该节点中重新启动了ELK。它是成功的。但是，一旦我在第二个ELK节点中配置了集群，第一个节点logstash将自动停止，出现以下错误

An unexpected error occurred! {:error=>#<LogStash::Outputs::ElasticSearch::
    HttpClient::Pool::HostUnreachableError: Could not reach host Manticore::SocketException:
    Connection refused (Connection refused)>, :backtrace=>["/opt///logstash/vendor
    /bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/
    elasticsearch/http_client/pool.rb:293:in perform_request_to_url'", "/opt/****/****/logstash /vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs /elasticsearch/http_client/pool.rb:278:in block in perform_request'", "/opt///
    logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/
    logstash/outputs/elasticsearch/http_client/pool.rb:373:in with_connection'", " /opt/****/****/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib /logstash/outputs/elasticsearch/http_client/pool.rb:277:in perform_request'",
    "/opt///logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-
    java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:285:in block in Pool'", "/opt/****/****/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0- java/lib/logstash/outputs/elasticsearch/http_client.rb:162:in get'", "/opt///logstash/
    ndor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/
    outputs/elasticsearch/http_client.rb:378:in get_xpack_info'", "/opt/****/****/logstash/ vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/ outputs/elasticsearch/ilm.rb:57:in ilm_ready?'", "/opt///logstash/vendor/bundle
    /jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/
    ilm.rb:28:in ilm_in_use?'", "/opt/****/****/logstash/vendor/bundle/jruby/2.5.0/gems/ logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/common.rb:52:in block in setup_after_successful_connection'"]}

cluster.name: "elasticsearch"
    node.name: "node-2"
    node.data: true
    path.logs: "/var/opt/logs/elasticsearch/"
    path.data: "/var/lib/elasticsearch"
    network.host: "**.**.**.**"
    http.port: 9200
    discovery.seed_hosts:
    - "**.**.**.**"
    - "**.**.**.**"
    cluster.initial_master_nodes:
    - "node-1"
    - "node-2" 

                                                          

和Im使用elasticsearch输出插件,我在其中添加了集群节点,如下所示。

elasticsearch 
            { 
       hosts => ["**.**.**.**:9200","**.**.**.**:9200"]
               document_id => "%{authsid}"
               index =>  "dashboard_write"
               script => "ctx._source.loginCount= params.event.get('loginCount');
                       ctx._source.contractName= params.event.get('contractName');
                        ctx._source.userName= params.event.get('userName');
                         ctx._source.sessionID= params.event.get('sessionID');
                         ctx._source.eventID= params.event.get('eventID');"
              doc_as_upsert => "true"
               action => "update"  
              ilm_enabled => false             
        }
        
       

我在第一个节点elasticsearch.yml和logstash output.conf文件中做了上述更改，并重新启动了第一个节点。它成功地出现了。然后我在第二个节点中做了相同的更改并重新启动了第二个节点，然后第一个节点logstash自动关闭

Answer 1

在我看来，您的logstash配置没有找到索引模板。在elasticsearch输出插件中有ilm_settings，但没有指定索引模板。所以,logstash试图找到错误的终点。这就是为什么你会出现错误。使用类似的方法,

elasticsearch {
    
    hosts => ["localhost:9200"]
    index => "index_name"
    manage_template => true
    template_overwrite => true
    ilm_enabled => false
    template_name => "template_name"
    template => "path_to_template"
    document_id => "document_id" 
    http_compression => true
}