[英]Packetbeat throws Bulk item insert failed error
Packetbeat throws following error Packetbeat引发以下错误
Bulk item insert failed 批量插入失败
When the following processor is added to packetbeat.yml 将以下处理器添加到packetbeat.yml时
processors.include_fields.fields: ["http.request.body"]
Error log 错误日志
2018-06-04T00:37:40.893+0530 ERROR pipeline/output.go:92 Failed to publish events: temporary bulk send failure
2018-06-04T00:37:40.893+0530 DEBUG [elasticsearch] elasticsearch/client.go:666 ES Ping(url=http://localhost:9200)
2018-06-04T00:37:40.894+0530 DEBUG [elasticsearch] elasticsearch/client.go:689 Ping status code: 200
2018-06-04T00:37:40.894+0530 INFO elasticsearch/client.go:690 Connected to Elasticsearch version 6.2.2
2018-06-04T00:37:40.894+0530 DEBUG [elasticsearch] elasticsearch/client.go:708 HEAD http://localhost:9200/_template/packetbeat-6.2.4 <nil>
2018-06-04T00:37:40.895+0530 INFO template/load.go:73 Template already exists and will not be overwritten.
2018-06-04T00:37:40.896+0530 DEBUG [elasticsearch] elasticsearch/client.go:303 PublishEvents: 1 events have been published to elasticsearch in 1.245631ms.
2018-06-04T00:37:40.896+0530 DEBUG [elasticsearch] elasticsearch/client.go:507 Bulk item insert failed (i=0, status=500): {"type":"string_index_out_of_bounds_exception","reason":"String index out of range: 0"}
Environment: elasticsearch version - 6.2.4 packetbeat version - 6.2.4 环境:elasticsearch版本-6.2.4 packetbeat版本-6.2.4
I managed to find the root course for this error. 我设法找到此错误的根源。 It was when adding following to packetbeat.yml 是在packetbeat.yml中添加以下内容时
index: "packetbeat-%{[beat.version]}-%{+yyyy.MM.dd.HH}"
when I removed it problem disappeared. 当我删除它的问题消失了。 seems to be a bug with custom index naming 自定义索引命名似乎是一个错误
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.