一.升级完毕打开Logstash运行日志观察提示如下错误信息:
[2017-12-19T16:30:14,283][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"logstash-dev-elastic01-app-2017.11.30", :_type=>"app", :_routing=>nil}, #<LogStash::Event:0x16db134e @data={"@timestamp"=>2017-12-19T16:30:14.267Z, "port"=>23639, "@version"=>"1", "host"=>"ip-00-00-00-00.eu-central-1.compute.internal", "@metdata"=>{"ip_address"=>"00.00.00.00"}, "message"=>"{\"hostname\":\"app1\",\"env\":\"him1\",\"level\":\"info\",\"message\":\"executing job close-incidents-job\",\"label\":\"cron\"}", "type"=>"app"}>], :response=>{"index"=>{"_index"=>"logstash-dev-elastic01-app-2017.12.19", "_type"=>"app", "_id"=>nil, "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"Failed to parse mapping [_default_]: [include_in_all] is not allowed for indices created on or after version 6.0.0 as [_all] is deprecated. As a replacement, you can use an [copy_to] on mapping fields to create your own catch all field.", "caused_by"=>{"type"=>"mapper_parsing_exception", "reason"=>"[include_in_all] is not allowed for indices created on or after version 6.0.0 as [_all] is deprecated. As a replacement, you can use an [copy_to] on mapping fields to create your own catch all field."}}}}}
错误特征:
Kibana无法有效接收到由Elasticsearch传递过来的来自Logstash的日志
错误原因:
Elasticsearch配置中的logstash模板仍在使用5.5.0的旧模板,新版不兼容
解决方法:
1.服务器上使用curl删除旧模板:
curl -XDELETE 'http://10.0.7.227:9200/_template/logstash'
2.接着重启Logstash,自动重新生成适配6.0.0的模板