ELK 相關問題

1、kibana 不能正常顯示索引數據，報錯Index has exceeded [1000000] - maximum allowed to be analyzed for highlighting

詳細報錯內容：

　　　　{"type":"illegal_argument_exception","reason":"The length of [message] field of [l60ZgW0Bv9XMTlnX27A_] doc of [syslog] index has exceeded [1000000] - maximum allowed to be analyzed for highlighting. This maximum can be set by changing the [index.highlight.max_analyzed_offset] index level setting. For large texts, indexing with offsets or term vectors is recommended!”}}

錯誤原因：索引偏移量默認是100000，超過了

最大遷移索引不能配置在配置文件中，只能接口修改

修改配置：

curl  -XPUT http://127.0.0.1:9200/esb-log/_settings -H 'Content-Type: application/json' -d' {"index" : {"highlight.max_analyzed_offset" : 100000000}}'

查看：

 

再次刷新kibana,可以正常顯示數據。