X-Pack和loghide-无弹搜索输出-X-Pack&Logstash-Nooutputtoelasticsearch

I have an installation of X-Pack, Elasticsearch & Logstash. Logstash is alreay reporting to elasticsearch for the monitoring part of X-Pack.

我安装了X-Pack、Elasticsearch和loghide。loghidden总是报告给X-Pack的监控部分。

---

Now I want logstash to pass through any beat that comes to the pipe to elasticsearch.

现在我想让loghide通过任何进入管道的节拍来进行弹索搜索。

---

I followed this guide here and created the mentioned user & role. I additionally created a role for each beat type that has the mentioned privileges and assigned the roles to the same user, (e.g. one for filebeat-*), using the information from here.

我按照这里的指南创建了上面提到的用户和角色。我还使用这里的信息为每个具有上述特权的拍类型创建了一个角色，并将角色分配给相同的用户(例如filebeat-*)。

My logstash.conflooks the following:

我的logstash。conflooks以下:

input {
  beats {
   port => 5044
  }
}
output {
  elasticsearch {
   hosts => ["http://localhost:9200"]
   index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
   document_type => "%{[@metadata][type]}"
   user => "user"
   password => "pass-word"
 }
  file {
   path => "C:\temp\%{[@metadata][beat]}-%{+YYYY.MM.dd}.log"
 }
}

I am getting files created (e.g. for filebeat) but the indices in elasticsearch are not created and no data appears in elasticsearch.

我正在获取创建的文件(例如filebeat)，但是在弹性搜索中没有创建索引，也没有数据出现在弹性搜索中。

Does anyone see if there is something wrong in the configuration? I am struggling since hours to find an error/solution.

有人看到配置有问题吗?我花了好几个小时才找到一个错误/解决方案。

Publishing beats directly to elasticsearch (without Logstash) using the mentioned user is working (e.g. using metricbeat).

使用上面提到的用户(例如使用metricbeat)直接将beats发布到elasticsearch(没有日志隐藏)。

Also I do not see something strange in the log, simply the output to elastic is missing:

我也没有看到在日志里有什么奇怪的东西，简单的输出到弹性是缺失的:

07:52:53.807 [[main]>worker0] DEBUG logstash.pipeline - filter received {"event"=>{...}}
07:52:53.807 [[main]>worker0] DEBUG logstash.pipeline - filter received {"event"=>{...}}
07:52:53.807 [[main]>worker0] DEBUG logstash.pipeline - output received {"event"=>{...}}
07:52:53.807 [[main]>worker0] DEBUG logstash.pipeline - output received {"event"=>{...}}
07:52:53.870 [[main]>worker0] DEBUG logstash.outputs.file - File, writing event to file. {:filename=>"C:/temp/filebeat-2017.04.11.log"}
07:52:53.870 [[main]>worker0] DEBUG logstash.outputs.file - File, writing event to file. {:filename=>"C:/temp/filebeat-2017.04.11.log"}
07:52:53.870 [[main]>worker0] INFO logstash.outputs.file - Opening file {:path=>"C:/temp/filebeat-2017.04.11.log"}
07:52:53.870 [[main]>worker0] DEBUG logstash.outputs.file - Starting stale files cleanup cycle {:files=>{"C:/temp/filebeat-2017.04.11.log"=>#>}}
07:52:53.870 [[main]>worker0] DEBUG logstash.outputs.file - 0 stale files found {:inactive_files=>{}}

07:52:53.807[[主要]> worker0]调试logstash。管道-过滤器接收到{"事件"=>{…[main]>worker0]调试日志隐藏。管道-过滤器接收到{"事件"=>{…[main]>worker0]调试日志隐藏。管道-接收到的输出{“事件”=>{…[main]>worker0]调试日志隐藏。管道-接收到的输出{“事件”=>{…[main]>worker0]调试日志。输出。文件-文件，写入事件文件。{:文件名= > " C:/ temp / filebeat-2017.04.11。[main]>worker0]调试日志。输出。文件-文件，写入事件到文件。{:文件名= > " C:/ temp / filebeat-2017.04.11。[main]>worker0] INFO logsta .output。文件打开文件{:路径=>"C:/temp/filebeat-2017.04.11。[main]>worker0]调试日志。输出。文件-启动过期文件清理周期{:files=>{"C:/temp/filebeat-2017.04.11。[font - family:宋体;mso - ascii - font - family: tahoma; mso - hansi - font - family: tahoma;文件- 0陈旧文件发现{:inactive_files=>{}

---

Thank you already!

谢谢你了!

---

UPDATE:

更新:

If I change the password, I get the following error in the logstash log:

如果我更改了密码，我将在登录日志中得到以下错误:

08:22:33.877 [[main]>worker1] ERROR logstash.outputs.elasticsearch - Got a bad response code from server, but this code is not considered retryable. Request will be dropped {:code=>401, :response_body=>"{\"error\":{\"root_cause\":[{\"type\":\"security_exception\",\"reason\":\"unable to authenticate user [beat] for REST request [/_bulk]\",\"header\":{\"WWW-Authenticate\":\"Basic realm=\\"security\\" charset=\\"UTF-8\\"\"}}],\"type\":\"security_exception\",\"reason\":\"unable to authenticate user [beat] for REST request [/_bulk]\",\"header\":{\"WWW-Authenticate\":\"Basic realm=\\"security\\" charset=\\"UTF-8\\"\"}},\"status\":401}", :request_body=>"{\"index\":{\"_id\":null,\"_index\"

08:22:33.877[[主要]> worker1]logstash.outputs错误。elasticsearch——从服务器上得到错误的响应代码，但是不认为这些代码是可重用的。请求将被删除{:代码= > 401,response_body = > " { \“错误\”:{ \“root_cause \”:[{ \“类型\”:\“security_exception \”,\“原因\”:\“无法验证用户(打)REST请求/ _bulk \”,\“头\”:{ \“WWW-Authenticate \”,\“基本领域= \ \ "安全\ \ " charset = \ \ " utf - 8 \ \“\”} }),\“类型\”:\“security_exception \”,\“原因\”:\“无法验证用户(打)REST请求/ _bulk \”,\“头\”:{ \“WWW-Authenticate \”,\“基本领域= \ \ "安全\ \ " charset = \ \ " utf - 8 \ \“\”} },\“地位\”:401 }”,:request_body = > " { \ "指数\ ":{ \“_id \”:null,\“_index \”

So it seems to be actually communicating with elasticsearch, but the index does not get created. Unfortunately I have no statement in the elasticsearch log.

看起来它实际上是在和弹性搜索通信，但是索引没有被创建。不幸的是，我在弹性搜索日志中没有声明。

1 个解决方案