Logstash output 到 ES 给我错误代码“400”

Question

我可以寻求帮助吗？

我正在使用以下内容：

• logstash v.6.1.5
• AWS ES v.7.9

我有以下logstash output：

    elasticsearch {
      hosts => ["es_host"]
      ssl => true
      user => "user"
      password => "password"
      template => '/etc/logstash/conf.d/template-default.json'
      template_overwrite => true
      index => "log-default-%{+yyyy-MM-dd}"
      ilm_enabled => false
    }

这是模板：

    "order": 1,
    "index_patterns": [
        "log-default-*",
        "log-http-*"
    ],
    "settings": {
        "number_of_shards": 6,
        "number_of_replicas": 2
    },
    "mappings": {
        "_default_": {
            "dynamic_templates": [
                {
                    "ips": {
                        "match_pattern": "regex",
                        "match": "^(?:orig_)?(?:src|dst)ip$",
                        "mapping": {
                            "type": "ip"
                        }
                    }
                },
                {
                    "strings": {
                        "match": "*",
                        "unmatch": "*message",
                        "match_mapping_type": "string",
                        "mapping": {
                            "type": "keyword"
                        }
                    }
                }
            ]
        }
    }
}

当我启动 logstash 时，我收到如下错误。 有谁知道可能出了什么问题？

[ERROR][logstash.outputs.elasticsearch] Failed to install template. {:message=>"Got response code '400' contacting Elasticsearch at URL 'https://es-host:443/_template/logstash'

Answer 1

你的template-default.json文件应该包含这个，即删除_default_键，你对 go 很好。

{
  "order": 1,
  "index_patterns": [
    "log-default-*",
    "log-http-*"
  ],
  "settings": {
    "number_of_shards": 6,
    "number_of_replicas": 2
  },
  "mappings": {
    "dynamic_templates": [
      {
        "ips": {
          "match_pattern": "regex",
          "match": "^(?:orig_)?(?:src|dst)ip$",
          "mapping": {
            "type": "ip"
          }
        }
      },
      {
        "strings": {
          "match": "*",
          "unmatch": "*message",
          "match_mapping_type": "string",
          "mapping": {
            "type": "keyword"
          }
        }
      }
    ]
  }
}