禁用日志“logstash.outputs.elasticsearch”

Question

I want to disable the continuous warn messages being outputted in the logs as

[2022-09-20T20:28:54,604][WARN ][logstash.outputs.elasticsearch][main] Attempted to resurrect connection to dead ES instance, but got an error {:url=>"http://elasticsearch:9200/", :exception=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::BadResponseCodeError, :message=>"Got response code '401' contacting Elasticsearch at URL 'http://elasticsearch:9200/'"}

I read multiple posts and xpack.monitoring.enabled: false seemed to have worked for people. My logstash config is

http.host: "0.0.0.0"
path.config: /usr/share/logstash/pipeline
pipeline.ecs_compatibility: disabled
xpack.monitoring.enabled: false

But i still keep getting those warn messages. Is there any way to get rid of them?

Answer 1

xpack.monitoring.enabled is only useful for shipping monitoring (but not logging.!) data to Elasticsearch.

You can update Logstash log levels either dynamically like this

curl -XPUT 'localhost:9600/_node/logging?pretty' -H 'Content-Type: application/json' -d'
{
    "logger.logstash.outputs.elasticsearch" : "ERROR"
}
'

or directly in the log4j.properties file

logger.elasticsearchoutput.name = logstash.outputs.elasticsearch
logger.elasticsearchoutput.level = error