Logstash弹性搜索

Question

尝试将Logstash与Elasticsearch连接时出现以下错误

        **log4j, [2015-01-17T17:19:00.559]  WARN: org.elasticsearch.discovery: [logstash-ip-10-181-166-160-1026-2020] waited for 30s and no initial state was set by the discovery**

logstash.conf

input {
      lumberjack {
        port => 5000
        type => "logs"
        ssl_certificate => "/etc/pki/tls/certs/logstash-forwarder.crt"
        ssl_key => "/etc/pki/tls/private/logstash-forwarder.key"

    }

    }

    filter {
    grok { match => [ "message", "%{TIME:log_time}\|%{WORD:Message_type}\|%{GREEDYDATA:Component}\|%{NUMBER:line_number}\| %{GREEDYDATA:log_message}"]
             match => [ "path" , "%{GREEDYDATA}/%{GREEDYDATA:loccode}/%{GREEDYDATA:_machine}\:%{DATE:logdate}.log"]
             break_on_match => false
    }

    stdout { codec => rubydebug }
    elasticsearch{
            embedded => false
            host => "localhost"
            #host => "http://xxx.xxx.xxx:9200"
            port => "9300"
            cluster=>"Elasticsearch-Logstash"
            manage_template=> false
            index=>"doppleml-%{loccode}-%{+YYYY.MM.dd}"
            #template=>"/home/hduser/elasticsearch/logstash-1.4.2/doppleML_template.json"
            #template=>"/home/ubuntu/elkproject/logstash-1.4.2/doppleML_template.json"

         }

    }

Elasticsearch.yml：

  network.host: localhost
    cluster.name: Elasticsearch-Logstash

我是否需要在logstash或Elasticsearch配置文件中包含任何更改？

Answer 1

如果您未设置协议，则可能默认为“ http”，但您直接将端口设置为“ 9300”，将无法正常工作。 我将协议设置为“ http”并将端口设置为“ 9200”，或者将协议设置为“ node”或“ transport”并将端口设置为“ 9300”。

文档的此页面有助于设置/调试Logstash和elasticsearch的输出设置：

http://logstash.net/docs/1.4.2/outputs/elasticsearch