解決logstash.outputs.elasticsearch[main] Could not index event to Elasticsearch status 404

 

 

 

 

現象：lostack啟動正常，logstack收集輸入redis數據，輸出到elasticsearch寫入失敗

提示：去建索引 的時候elasticsearch返回404

 

 

[2019-11-12T11:37:29,009][WARN ][logstash.outputs.elasticsearch][main] Could not index event to Elasticsearch. {:status=>404, :action=>["index", {:_id=>nil, :_index=>"nginx-172.16.2.13-2019.11.12", :_type=>"doc", :_routing=>nil}, #<LogStash::Event:0x26f38258>], :response=>{"index"=>{"_index"=>"nginx-172.16.2.13-2019.11.12", "_type"=>"doc", "_id"=>nil, "status"=>404, "error"=>{"type"=>"index_not_found_exception", "reason"=>"no such index", "resource.type"=>"index_expression", "resource.id"=>"nginx-172.16.2.13-2019.11.12", "index_uuid"=>"_na_", "index"=>"nginx-172.16.2.13-2019.11.12"}}}}

 

解決方法：

因elasticsearch配置問題導致，action.auto_create_index: false   #禁用自動創建index

將false改成true即可，或者刪除這個配置，查閱官方文檔改配置是默認開啟的。

 

希望能幫你解決。