ES(Windows)不能通过Logstash进行写数据
服务器:Windows
版本:ELK(ES-Logstash-Kibana)版本6.5.0
Logstash日志输出报错:
[2020-05-16T09:10:19,044][INFO ][logstash.outputs.elasticsearch] retrying failed action with response code:503({"type"=>"unavailable_shards_exception","reason"=>"[order_index][2] primary shard is not active Timeout:[1m], request:[BulkShardRequest [[order_index][2]]containing [31] requests]"})
[2020-05-16T09:10:19,044][INFO ][logstash.outputs.elasticsearch] Retrying individual bulk actions that failed or were rejected by the previous bulk request. {:count=>31}
原因推测:Logstash同步的数据太多,导致线程卡死、数据结构错误
临时解决方法:关闭Logstash和ES,然后先启动ES,后启动Logstash,注意Logstash的启动命令是 logstash.bat -f logstash.conf 。然后按照官网的文档重建索引,等待15分钟同步执行就好了
最终解决方法:要想解决得把这个6.5的es升级到7.5以上的版本
临时解决方法步骤:
#当ES只进行读数据,可在Kibana中设置该操作
PUT _settings
{
"index": {
"blocks": {
"read_only_allow_delete": "false"
}
}
}
#1.查看索引状态,如果是red,需要重建索引
GET /_cat/indices
#2.删除red索引,慎重!!!
DELETE order_index
#3.创建新的索引
#注意:复制Kibana中Management -> Index management -> order_index详情 -> 详情中的Mapping,放在PUT中要将mapping改为mappings
PUT /order_index
{
"mappings": {
...
}
}
参考文档:
https://blog.csdn.net/zhumengguang/article/details/112725904
如有错误请评论指正。