為了使用X-Pack強(qiáng)大的特性，我分別在Kibana, Logstash和Elasticsearch根目錄中安裝了X-Pack插件，安裝完成重啟各軟件之后，滿心歡喜攒庵。可是隨后令人蛋痛的事情發(fā)生了败晴，Logstash不能正常工作叙甸。
查看日志文件：/var/log/logstash/logstash-plain.log
[2017-09-01T10:38:34,940][ERROR][logstash.outputs.elasticsearch] Got a bad response code from server, but this code is not considered retryable. Request will be dropped {:code=>401, :response_body=>"{\"error\":{\"root_cause\":[{\"type\":\"security_exception\",\"reason\":\"missing authentication token for REST request [/_bulk]\",\"header\":{\"WWW-Authenticate\":\"Basic realm=\\\"security\\\" charset=\\\"UTF-8\\\"\"}}],\"type\":\"security_exception\",\"reason\":\"missing authentication token for REST request [/_bulk]\",\"header\":{\"WWW-Authenticate\":\"Basic realm=\\\"security\\\" charset=\\\"UTF-8\\\"\"}},\"status\":401}"}
我以為Kibana有安全認(rèn)證，輸入密碼登錄就好位衩，沒(méi)想到Logstash訪問(wèn)Elasticsearch也要認(rèn)證。那我就老老實(shí)實(shí)在Logstash配置中添加認(rèn)證信息
output {
elasticsearch {
hosts => ["http://10.10.40.170:9200"]
user => logstash_system
password => changeme
manage_template => true
index => "logstash-%{type}-%{+YYYY-MM-dd}"
}
stdout { codec => rubydebug }
}
主要是加入了賬號(hào)和密碼熔萧。
OK糖驴。重啟開(kāi)始驗(yàn)證。
佛致。。俺榆。
還是不行，再次查看日志,發(fā)現(xiàn)每三秒出現(xiàn)一次如下的錯(cuò)誤：
[2017-09-01T22:37:05,902][INFO ][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck_url=>http://logstash_system:xxxxxx@localhost:9200/, :path=>"/"}
[2017-09-01T22:37:05,907][WARN ][logstash.outputs.elasticsearch] Attempted to resurrect connection to dead ES instance, but got an error. {:url=>"http://logstash_system:xxxxxx@localhost:9200/", :error_type=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :error=>"Elasticsearch Unreachable: [http://logstash_system:xxxxxx@localhost:9200/][Manticore::SocketException] Connection refused (Connection refused)"}
[2017-09-01T22:37:08,037][WARN ][logstash.shutdownwatcher ] {"inflight_count"=>1, "stalling_thread_info"=>{"other"=>[{"thread_id"=>24, "name"=>"[.monitoring-logstash]>worker0", "current_call"=>"[...]/vendor/bundle/jruby/1.9/gems/stud-0.0.23/lib/stud/interval.rb:89:in `sleep'"}]}}
我明明配置了Elasticsearch的hosts定嗓，怎么還是loccalhost蜕琴。百思不得其解，陷入抓狂中宵溅。
一度以為是這個(gè)配置文件格式有問(wèn)題，但是后來(lái)想想并不是恃逻，格式不對(duì)應(yīng)該提示格式錯(cuò)誤，這分明是網(wǎng)絡(luò)錯(cuò)誤寇损。
最后還是仔細(xì)分析錯(cuò)誤日志凸郑，health check是安裝X-Pack之后才出現(xiàn)的，一查原來(lái)是X-Pack的監(jiān)控矛市。
https://www.elastic.co/guide/en/x-pack/current/monitoring-logstash.html
根據(jù)文中所說(shuō)芙沥，這里默認(rèn)的elasticsearch.url 就是那個(gè)該死的localhost:9200尘盼。
找到了問(wèn)題根本所在，打開(kāi)/etc/logstash/logstash.yml重新配置即可
xpack.monitoring.elasticsearch.url: ["http://10.10.40.170"]
xpack.monitoring.elasticsearch.username: "logstash_system"
xpack.monitoring.elasticsearch.password: "changeme"
重啟之后卿捎，Logstash又恢復(fù)了正常。
