elk+filebeat架构，大概15小时后，就没有日志显示了

没有数据可以从以下几个部分排查：
1、elk+filebeat是否正常运行
2、检查elk与filebeat之间网络是否通畅，相应端口是否开放
3、查看filebeat监控的目录是不是准确的。曾经还犯过在服务器上不同目录启动tomcat时日志输出目录不同
4、如果是用kibana看不到数据，可以看是不是elk服务器和安装了filebeat服务器的时间不准确。我有次就是时间不对，用kibana设置的时间过滤条件查看时没有数据
 

今天8点没数据了，然后发现redis是空的，filebeat没有把数据传到redis

这张展开了，

兄弟我发现这个值（Top 5 values in 500 / 500 records）都到500了

你每天的数据量大概在多少，es有相关日志报错吗

数据量每天300M吧，现在是测试，我只用了一个yin日应用的日志；
 es日志美没有报错：
4月3日：
[2018-04-03T06:25:16,926][INFO ][o.e.n.Node               ] [] initializing ...
[2018-04-03T06:25:17,008][INFO ][o.e.e.NodeEnvironment    ] [C6mwFvG] using [1] data paths, mounts [[/ (rootfs)]], net usable_space [320.4gb], net total_space [499.6gb], types [rootfs]
[2018-04-03T06:25:17,009][INFO ][o.e.e.NodeEnvironment    ] [C6mwFvG] heap size [989.8mb], compressed ordinary object pointers [true]
[2018-04-03T06:25:17,010][INFO ][o.e.n.Node               ] node name [C6mwFvG] derived from node ID [C6mwFvGTTvinYJKlRavkCQ]; set [node.name] to override
[2018-04-03T06:25:17,010][INFO ][o.e.n.Node               ] version[6.1.2], pid[404], build[5b1fea5/2018-01-10T02:35:59.208Z], OS[Linux/3.10.0-514.26.2.el7.x86_64/amd64], JVM[Oracle Corporation/Java HotSpot(TM) 64-Bit Server VM/1.8.0_101/25.101-b13]
[2018-04-03T06:25:17,010][INFO ][o.e.n.Node               ] JVM arguments [-Xms1g, -Xmx1g, -XX:+UseConcMarkSweepGC, -XX:CMSInitiatingOccupancyFraction=75, -XX:+UseCMSInitiatingOccupancyOnly, -XX:+AlwaysPreTouch, -Xss1m, -Djava.awt.headless=true, -Dfile.encoding=UTF-8, -Djna.nosys=true, -XX:-OmitStackTraceInFastThrow, -Dio.netty.noUnsafe=true, -Dio.netty.noKeySetOptimization=true, -Dio.netty.recycler.maxCapacityPerThread=0, -Dlog4j.shutdownHookEnabled=false, -Dlog4j2.disable.jmx=true, -XX:+HeapDumpOnOutOfMemoryError, -Des.path.home=/usr/local/elk/elasticsearch-6.1.2, -Des.path.conf=/usr/local/elk/elasticsearch-6.1.2/config]
[2018-04-03T06:25:17,888][INFO ][o.e.p.PluginsService     ] [C6mwFvG] loaded module [aggs-matrix-stats]
[2018-04-03T06:25:17,888][INFO ][o.e.p.PluginsService     ] [C6mwFvG] loaded module [analysis-common]
[2018-04-03T06:25:17,889][INFO ][o.e.p.PluginsService     ] [C6mwFvG] loaded module [ingest-common]
[2018-04-03T06:25:17,889][INFO ][o.e.p.PluginsService     ] [C6mwFvG] loaded module [lang-expression]
[2018-04-03T06:25:17,889][INFO ][o.e.p.PluginsService     ] [C6mwFvG] loaded module [lang-mustache]
[2018-04-03T06:25:17,889][INFO ][o.e.p.PluginsService     ] [C6mwFvG] loaded module [lang-painless]
[2018-04-03T06:25:17,889][INFO ][o.e.p.PluginsService     ] [C6mwFvG] loaded module [mapper-extras]
[2018-04-03T06:25:17,889][INFO ][o.e.p.PluginsService     ] [C6mwFvG] loaded module [parent-join]
[2018-04-03T06:25:17,889][INFO ][o.e.p.PluginsService     ] [C6mwFvG] loaded module [percolator]
[2018-04-03T06:25:17,890][INFO ][o.e.p.PluginsService     ] [C6mwFvG] loaded module [reindex]
[2018-04-03T06:25:17,890][INFO ][o.e.p.PluginsService     ] [C6mwFvG] loaded module [repository-url]
[2018-04-03T06:25:17,890][INFO ][o.e.p.PluginsService     ] [C6mwFvG] loaded module [transport-netty4]
[2018-04-03T06:25:17,890][INFO ][o.e.p.PluginsService     ] [C6mwFvG] loaded module [tribe]
[2018-04-03T06:25:17,890][INFO ][o.e.p.PluginsService     ] [C6mwFvG] no plugins loaded
[2018-04-03T06:25:19,151][INFO ][o.e.d.DiscoveryModule    ] [C6mwFvG] using discovery type [zen]
[2018-04-03T06:25:19,612][INFO ][o.e.n.Node               ] initialized
[2018-04-03T06:25:19,612][INFO ][o.e.n.Node               ] [C6mwFvG] starting ...
[2018-04-03T06:25:19,732][INFO ][o.e.t.TransportService   ] [C6mwFvG] publish_address {192.168.0.19:9300}, bound_addresses {0.0.0.0:9300}
[2018-04-03T06:25:19,741][INFO ][o.e.b.BootstrapChecks    ] [C6mwFvG] bound or publishing to a non-loopback address, enforcing bootstrap checks
[2018-04-03T06:25:22,811][INFO ][o.e.c.s.MasterService    ] [C6mwFvG] zen-disco-elected-as-master ([0] nodes joined), reason: new_master {C6mwFvG}{C6mwFvGTTvinYJKlRavkCQ}{N0-XW1MVTp6A9q1S3Gw-qA}{192.168.0.19}{192.168.0.19:9300}
[2018-04-03T06:25:22,816][INFO ][o.e.c.s.ClusterApplierService] [C6mwFvG] new_master {C6mwFvG}{C6mwFvGTTvinYJKlRavkCQ}{N0-XW1MVTp6A9q1S3Gw-qA}{192.168.0.19}{192.168.0.19:9300}, reason: apply cluster state (from master [master {C6mwFvG}{C6mwFvGTTvinYJKlRavkCQ}{N0-XW1MVTp6A9q1S3Gw-qA}{192.168.0.19}{192.168.0.19:9300} committed version [1] source [zen-disco-elected-as-master ([0] nodes joined)]])
[2018-04-03T06:25:22,831][INFO ][o.e.h.n.Netty4HttpServerTransport] [C6mwFvG] publish_address {192.168.0.19:9200}, bound_addresses {0.0.0.0:9200}
[2018-04-03T06:25:22,831][INFO ][o.e.n.Node               ] [C6mwFvG] started
[2018-04-03T06:25:22,841][INFO ][o.e.g.GatewayService     ] [C6mwFvG] recovered [0] indices into cluster_state
[2018-04-03T06:26:10,023][INFO ][o.e.n.Node               ] [C6mwFvG] stopping ...
[2018-04-03T06:26:10,053][INFO ][o.e.n.Node               ] [C6mwFvG] stopped
[2018-04-03T06:26:10,053][INFO ][o.e.n.Node               ] [C6mwFvG] closing ...
[2018-04-03T06:26:10,061][INFO ][o.e.n.Node               ] [C6mwFvG] closed
[2018-04-03T06:26:16,889][INFO ][o.e.n.Node               ] [] initializing ...
[2018-04-03T06:26:16,966][INFO ][o.e.e.NodeEnvironment    ] [C6mwFvG] using [1] data paths, mounts [[/ (rootfs)]], net usable_space [320.4gb], net total_space [499.6gb], types [rootfs]
[2018-04-03T06:26:16,967][INFO ][o.e.e.NodeEnvironment    ] [C6mwFvG] heap size [989.8mb], compressed ordinary object pointers [true]
[2018-04-03T06:26:16,968][INFO ][o.e.n.Node               ] node name [C6mwFvG] derived from node ID [C6mwFvGTTvinYJKlRavkCQ]; set [node.name] to override
[2018-04-03T06:26:16,968][INFO ][o.e.n.Node               ] version[6.1.2], pid[571], build[5b1fea5/2018-01-10T02:35:59.208Z], OS[Linux/3.10.0-514.26.2.el7.x86_64/amd64], JVM[Oracle Corporation/Java HotSpot(TM) 64-Bit Server VM/1.8.0_101/25.101-b13]
[2018-04-03T06:26:16,968][INFO ][o.e.n.Node               ] JVM arguments [-Xms1g, -Xmx1g, -XX:+UseConcMarkSweepGC, -XX:CMSInitiatingOccupancyFraction=75, -XX:+UseCMSInitiatingOccupancyOnly, -XX:+AlwaysPreTouch, -Xss1m, -Djava.awt.headless=true, -Dfile.encoding=UTF-8, -Djna.nosys=true, -XX:-OmitStackTraceInFastThrow, -Dio.netty.noUnsafe=true, -Dio.netty.noKeySetOptimization=true, -Dio.netty.recycler.maxCapacityPerThread=0, -Dlog4j.shutdownHookEnabled=false, -Dlog4j2.disable.jmx=true, -XX:+HeapDumpOnOutOfMemoryError, -Des.path.home=/usr/local/elk/elasticsearch-6.1.2, -Des.path.conf=/usr/local/elk/elasticsearch-6.1.2/config]
[2018-04-03T06:26:17,867][INFO ][o.e.p.PluginsService     ] [C6mwFvG] loaded module [aggs-matrix-stats]
[2018-04-03T06:26:17,867][INFO ][o.e.p.PluginsService     ] [C6mwFvG] loaded module [analysis-common]
[2018-04-03T06:26:17,867][INFO ][o.e.p.PluginsService     ] [C6mwFvG] loaded module [ingest-common]
[2018-04-03T06:26:17,867][INFO ][o.e.p.PluginsService     ] [C6mwFvG] loaded module [lang-expression]
[2018-04-03T06:26:17,867][INFO ][o.e.p.PluginsService     ] [C6mwFvG] loaded module [lang-mustache]
[2018-04-03T06:26:17,867][INFO ][o.e.p.PluginsService     ] [C6mwFvG] loaded module [lang-painless]
[2018-04-03T06:26:17,867][INFO ][o.e.p.PluginsService     ] [C6mwFvG] loaded module [mapper-extras]
[2018-04-03T06:26:17,867][INFO ][o.e.p.PluginsService     ] [C6mwFvG] loaded module [parent-join]
[2018-04-03T06:26:17,867][INFO ][o.e.p.PluginsService     ] [C6mwFvG] loaded module [percolator]
[2018-04-03T06:26:17,868][INFO ][o.e.p.PluginsService     ] [C6mwFvG] loaded module [reindex]
[2018-04-03T06:26:17,868][INFO ][o.e.p.PluginsService     ] [C6mwFvG] loaded module [repository-url]
[2018-04-03T06:26:17,868][INFO ][o.e.p.PluginsService     ] [C6mwFvG] loaded module [transport-netty4]
[2018-04-03T06:26:17,868][INFO ][o.e.p.PluginsService     ] [C6mwFvG] loaded module [tribe]
[2018-04-03T06:26:17,868][INFO ][o.e.p.PluginsService     ] [C6mwFvG] no plugins loaded
[2018-04-03T06:26:19,139][INFO ][o.e.d.DiscoveryModule    ] [C6mwFvG] using discovery type [zen]
[2018-04-03T06:26:19,590][INFO ][o.e.n.Node               ] initialized
[2018-04-03T06:26:19,590][INFO ][o.e.n.Node               ] [C6mwFvG] starting ...
[2018-04-03T06:26:19,731][INFO ][o.e.t.TransportService   ] [C6mwFvG] publish_address {192.168.0.19:9300}, bound_addresses {0.0.0.0:9300}
[2018-04-03T06:26:19,740][INFO ][o.e.b.BootstrapChecks    ] [C6mwFvG] bound or publishing to a non-loopback address, enforcing bootstrap checks
[2018-04-03T06:26:22,862][INFO ][o.e.c.s.MasterService    ] [C6mwFvG] zen-disco-elected-as-master ([0] nodes joined), reason: new_master {C6mwFvG}{C6mwFvGTTvinYJKlRavkCQ}{PN6NoDrNQU6sFLoyHfeARg}{192.168.0.19}{192.168.0.19:9300}
[2018-04-03T06:26:22,867][INFO ][o.e.c.s.ClusterApplierService] [C6mwFvG] new_master {C6mwFvG}{C6mwFvGTTvinYJKlRavkCQ}{PN6NoDrNQU6sFLoyHfeARg}{192.168.0.19}{192.168.0.19:9300}, reason: apply cluster state (from master [master {C6mwFvG}{C6mwFvGTTvinYJKlRavkCQ}{PN6NoDrNQU6sFLoyHfeARg}{192.168.0.19}{192.168.0.19:9300} committed version [1] source [zen-disco-elected-as-master ([0] nodes joined)]])
[2018-04-03T06:26:22,882][INFO ][o.e.h.n.Netty4HttpServerTransport] [C6mwFvG] publish_address {192.168.0.19:9200}, bound_addresses {0.0.0.0:9200}
[2018-04-03T06:26:22,882][INFO ][o.e.n.Node               ] [C6mwFvG] started
[2018-04-03T06:26:22,892][INFO ][o.e.g.GatewayService     ] [C6mwFvG] recovered [0] indices into cluster_state
[2018-04-03T06:27:51,854][INFO ][o.e.c.m.MetaDataCreateIndexService] [C6mwFvG] [logstash-2018.04.03] creating index, cause [auto(bulk api)], templates [logstash], shards [5]/[1], mappings [_default_]
[2018-04-03T06:27:52,301][INFO ][o.e.c.m.MetaDataMappingService] [C6mwFvG] [logstash-2018.04.03/-gWysF5kRxeJYLLcZb2lMg] create_mapping [doc]
[2018-04-03T06:34:45,207][INFO ][o.e.c.m.MetaDataCreateIndexService] [C6mwFvG] [.kibana] creating index, cause [auto(bulk api)], templates [kibana_index_template:.kibana], shards [1]/[1], mappings [doc]
[2018-04-03T06:34:47,275][INFO ][o.e.c.m.MetaDataMappingService] [C6mwFvG] [.kibana/m5buukl5TemsLCCRJF9AQA] update_mapping [doc]
[2018-04-03T08:30:21,667][INFO ][o.e.c.m.MetaDataMappingService] [C6mwFvG] [logstash-2018.04.03/-gWysF5kRxeJYLLcZb2lMg] update_mapping [doc]
 
 
 
 
4月4日：
[2018-04-04T00:00:02,096][INFO ][o.e.c.m.MetaDataCreateIndexService] [C6mwFvG] [logstash-2018.04.04] creating index, cause [auto(bulk api)], templates [logstash], shards [5]/[1], mappings [_default_]
[2018-04-04T00:00:02,222][INFO ][o.e.c.m.MetaDataMappingService] [C6mwFvG] [logstash-2018.04.04/5JA23dNHRcKf7kUIDIvv9Q] create_mapping [doc]
 
 
 
 
 
4月5日：
[2018-04-05T00:00:01,516][INFO ][o.e.c.m.MetaDataCreateIndexService] [C6mwFvG] [logstash-2018.04.05] creating index, cause [auto(bulk api)], templates [logstash], shards [5]/[1], mappings [_default_]
[2018-04-05T00:00:01,647][INFO ][o.e.c.m.MetaDataMappingService] [C6mwFvG] [logstash-2018.04.05/OurX0-Y6RE-OhLdB78nYPg] create_mapping [doc]
 
 
 
 
 
 

磁盘使用38%，我的elk搭到一个docker里面，主目录在data，然后redis在另外一个docker