elasticsearch - 在Elasticsearch重新启动后，Logstash停止写到Elasticsearch吗？

Question

我对Logstash / Elasticsearch / Kibana相当陌生，并且在Elasticsearch停止并重新启动后恢复Logstash时遇到了一个奇怪的问题。我安装了带logstash-1.4.2和elasticsearch-1.3.4的ELK。

这是我的情况:

1-开始 flex 搜寻
2-在远程节点上启动logstash logforwarder
3-日志文件/事件已成功写入Elasticsearch
4-重新启动elasticsearch
5-Logstash重新连接到 flex 搜索(我看到以下消息)，但是事件不再插入到elasticsearch

Logstash日志:

log4j, [2014-11-15T16:16:20.261]  INFO: org.elasticsearch.cluster.service: [logstash-grading-n1-76848-4038] removed {[logstash-rest-n1-168118-4018][o6Gxxd1SQC2XchlsySaz8Q][rest-n1][inet[/10.165.0.31:9300]]{client=true, data=false},[Dorma][DoIcmge9QdqxiRnmBjtVdg][build][inet[/10.165.1.140:9300]],[logstash-web-n1-221006-4016][vRY0Ib7oTyOuliOYekP_nA][web-n1][inet[/10.165.0.21:9300]]{client=true, data=false},[logstash-flume-n1-99849-4018][KNknQCs0TPi6-VgiC4f-8A][flume-n1][inet[/10.165.0.41:9300]]{client=true, data=false},}, reason: zen-disco-master_failed ([Dorma][DoIcmge9QdqxiRnmBjtVdg][build][inet[/10.165.1.140:9300]])
log4j, [2014-11-16T09:08:38.706]  INFO: org.elasticsearch.cluster.service: [logstash-grading-n1-76848-4038] detected_master [Masque][5mLN45_iTfq_YuFKV20OLg][build][inet[/10.165.1.140:9300]], added {[logstash-rest-n1-168118-4018][o6Gxxd1SQC2XchlsySaz8Q][rest-n1][inet[/10.165.0.31:9300]]{client=true, data=false},[logstash-web-n1-221006-4016][vRY0Ib7oTyOuliOYekP_nA][web-n1][inet[/10.165.0.21:9300]]{client=true, data=false},[Masque][5mLN45_iTfq_YuFKV20OLg][build][inet[/10.165.1.140:9300]],}, reason: zen-disco-receive(from master [[Masque][5mLN45_iTfq_YuFKV20OLg][build][inet[/10.165.1.140:9300]]])
log4j, [2014-11-16T09:08:38.719]  INFO: org.elasticsearch.cluster.service: [logstash-grading-n1-76848-4038] added {[logstash-flume-n1-99849-4018][KNknQCs0TPi6-VgiC4f-8A][flume-n1][inet[/10.165.0.41:9300]]{client=true, data=false},}, reason: zen-disco-receive(from master [[Masque][5mLN45_iTfq_YuFKV20OLg][build][inet[/10.165.1.140:9300]]])

flex 搜索日志:

[2014-11-16 09:08:36,248][INFO ][gateway                  ] [Masque] recovered [8] indices into cluster_state
...
[2014-11-16 09:09:39,085][INFO ][cluster.service          ] [Masque] added {[logstash-grading-n1-76848-4038][8szJ9egnQsaAvet6S10Tmw][grading-n1][inet[/10.165.0.71:9300]]{client=true, data=false},}, reason: zen-disco-receive(join from node[[logstash-grading-n1-76848-4038][8szJ9egnQsaAvet6S10Tmw][grading-n1][inet[/10.165.0.71:9300]]{client=true, data=false}])

6-重新启动logstash-事件再次开始工作

所以问题是 ，我不想因为 flex 搜索重新启动而不必重新启动集群中的所有logstash 实例。有人有什么想法吗？我是否缺少某些配置？

Answer 1

这看起来像一个已知的logstash问题:

“Elasticsearch重新启动时无限挂起”

https://github.com/elasticsearch/logstash/issues/1655

除了重新启动logstash之外，没有其他已知的解决方法。我想评论一下您在此问题中的问题-谈论这个问题的人越多，解决问题的速度就越快。