ELK由5.5.x升级到6.0.0的错误及其解决办法收集
2017-12-19 17:36
1201 查看
一.升级完毕打开Logstash运行日志观察提示如下错误信息:
[2017-12-19T16:30:14,283][WARN
][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"logstash-dev-elastic01-app-2017.11.30", :_type=>"app", :_routing=>nil}, #<LogStash::Event:0x16db134e @data={"@timestamp"=>2017-12-19T16:30:14.267Z,
"port"=>23639, "@version"=>"1", "host"=>"ip-00-00-00-00.eu-central-1.compute.internal", "@metdata"=>{"ip_address"=>"00.00.00.00"}, "message"=>"{\"hostname\":\"app1\",\"env\":\"him1\",\"level\":\"info\",\"message\":\"executing job close-incidents-job\",\"label\":\"cron\"}",
"type"=>"app"}>], :response=>{"index"=>{"_index"=>"logstash-dev-elastic01-app-2017.12.19", "_type"=>"app", "_id"=>nil, "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"Failed to parse mapping [_default_]: [include_in_all] is not allowed
for indices created on or after version 6.0.0 as [_all] is deprecated. As a replacement, you can use an [copy_to] on mapping fields to create your own catch all field.", "caused_by"=>{"type"=>"mapper_parsing_exception", "reason"=>"[include_in_all] is not allowed
for indices created on or after version 6.0.0 as [_all] is deprecated. As a replacement, you can use an [copy_to] on mapping fields to create your own catch all field."}}}}}
错误特征:
Kibana无法有效接收到由Elasticsearch传递过来的来自Logstash的日志
错误原因:
Elasticsearch配置中的logstash模板仍在使用5.5.0的旧模板,新版不兼容
解决方法:
1.服务器上使用curl删除旧模板:
curl -XDELETE 'http://10.0.7.227:9200/_template/logstash'
2.接着重启Logstash,自动重新生成适配6.0.0的模板
[2017-12-19T16:30:14,283][WARN
][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"logstash-dev-elastic01-app-2017.11.30", :_type=>"app", :_routing=>nil}, #<LogStash::Event:0x16db134e @data={"@timestamp"=>2017-12-19T16:30:14.267Z,
"port"=>23639, "@version"=>"1", "host"=>"ip-00-00-00-00.eu-central-1.compute.internal", "@metdata"=>{"ip_address"=>"00.00.00.00"}, "message"=>"{\"hostname\":\"app1\",\"env\":\"him1\",\"level\":\"info\",\"message\":\"executing job close-incidents-job\",\"label\":\"cron\"}",
"type"=>"app"}>], :response=>{"index"=>{"_index"=>"logstash-dev-elastic01-app-2017.12.19", "_type"=>"app", "_id"=>nil, "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"Failed to parse mapping [_default_]: [include_in_all] is not allowed
for indices created on or after version 6.0.0 as [_all] is deprecated. As a replacement, you can use an [copy_to] on mapping fields to create your own catch all field.", "caused_by"=>{"type"=>"mapper_parsing_exception", "reason"=>"[include_in_all] is not allowed
for indices created on or after version 6.0.0 as [_all] is deprecated. As a replacement, you can use an [copy_to] on mapping fields to create your own catch all field."}}}}}
错误特征:
Kibana无法有效接收到由Elasticsearch传递过来的来自Logstash的日志
错误原因:
Elasticsearch配置中的logstash模板仍在使用5.5.0的旧模板,新版不兼容
解决方法:
1.服务器上使用curl删除旧模板:
curl -XDELETE 'http://10.0.7.227:9200/_template/logstash'
2.接着重启Logstash,自动重新生成适配6.0.0的模板
相关文章推荐
- VCSA5.5升级6.5u1提示VUM出错和证书错误的解决办法
- 一个数据库远程访问错误及其解决办法(启用 JIT 调试后,任何无法处理的异常)
- 升级Win10时出现错误代码80240020的解决办法
- 常见编译/链接错误及其解决办法
- ubuntu 12.04.1升级至ubuntu 12.10出现gcc-4.7依赖库错误的解决办法
- open_basedir restriction in effect的错误及其解决办法
- UBUNTU下QT开发应用程序常见错误及其解决办法
- github常见操作和常见错误及其解决办法
- 【转】 C++常见编译/链接错误及其解决办法
- Xcode升级到7.1出现itms-90049 错误 的解决办法
- Win10 TH2正式版升级遇到错误0xC1900101的临时解决办法
- iOS开发编译时候报的错误和解决办法收集
- Bigcommerce:PHP版本升级错误解决办法
- MS SQL Server错误收集以及解决办法
- WEB 开发错误收集(一)java java.lang.NoClassDefFoundError 的解决办法
- MAC 系统升级10.10以后PHP验证码错误的解决办法。[ 一行代码轻松解决! ]
- orchard模块编写的错误及其解决办法
- php版本从5.3升级到5.5以后,老版的phpmyadmin没法使用的解决办法
- 关于Android SDK更新之后引发的一系列错误及其解决办法——DIY Android SDK 的体验
- Win10升级遇到错误C1900101-30018的完美解决办法