elasticsearch - Logstash- Elasticsearch

Question

尝试将 Logstash 与 Elasticsearch 连接时出现以下错误

        **log4j, [2015-01-17T17:19:00.559]  WARN: org.elasticsearch.discovery: [logstash-ip-10-181-166-160-1026-2020] waited for 30s and no initial state was set by the discovery**

logstash.conf

input {
      lumberjack {
        port => 5000
        type => "logs"
        ssl_certificate => "/etc/pki/tls/certs/logstash-forwarder.crt"
        ssl_key => "/etc/pki/tls/private/logstash-forwarder.key"

    }

    }

    filter {
    grok { match => [ "message", "%{TIME:log_time}\|%{WORD:Message_type}\|%{GREEDYDATA:Component}\|%{NUMBER:line_number}\| %{GREEDYDATA:log_message}"]
             match => [ "path" , "%{GREEDYDATA}/%{GREEDYDATA:loccode}/%{GREEDYDATA:_machine}\:%{DATE:logdate}.log"]
             break_on_match => false
    }

    stdout { codec => rubydebug }
    elasticsearch{
            embedded => false
            host => "localhost"
            #host => "http://xxx.xxx.xxx:9200"
            port => "9300"
            cluster=>"Elasticsearch-Logstash"
            manage_template=> false
            index=>"doppleml-%{loccode}-%{+YYYY.MM.dd}"
            #template=>"/home/hduser/elasticsearch/logstash-1.4.2/doppleML_template.json"
            #template=>"/home/ubuntu/elkproject/logstash-1.4.2/doppleML_template.json"

         }

    }

Elasticsearch.yml:

  network.host: localhost
    cluster.name: Elasticsearch-Logstash

我是否需要在 logstash 或 Elasticsearch 配置文件中包含任何更改？

Answer 1

如果您没有设置协议(protocol)，它可能默认为“http”，但您直接将端口设置为“9300”，这是行不通的。我要么将协议(protocol)设置为“http”并将端口设置为“9200”，要么将协议(protocol)设置为“节点”或“传输”并将端口设置为“9300”。

该文档页面有助于设置/调试 logstash 和 elasticsearch 的输出设置:

http://logstash.net/docs/1.4.2/outputs/elasticsearch