提示日志长度超长,如何解决

作者 nathon | 发布于2018年09月14日 | 阅读数:142

[2018-09-13T20:00:24,515][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"logstash-docker-business-2018-09-13", :_type=>"xiaopeng_datacenter_log", :_routing=>nil}, 2018-09-13T12:00:15.964Z 2bf557d1b15f %{message}], :response=>{"index"=>{"_index"=>"logstash-docker-business-2018-09-13", "_type"=>"xiaopeng_datacenter_log", "_id"=>"AWXSzbzCGNuyXfNUtK_1", "status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"Document contains at least one immense term in field=\"event.keyword\" (whose UTF8 encoding is longer than the max length 32766), all of which were skipped. Please correct the analyzer to not produce such terms. The prefix of the first immense term is: '[114, 111, 111, 116, 58, 32, 100, 98, 99, 101, 110, 116, 101, 114, 45, 62, 77, 111, 98, 105, 108, 101, 95, 109, 111, 100, 101, 108, 45, 62]...', original message: bytes can be at most 32766 in length; got 35318", "caused_by"=>{"type"=>"max_bytes_length_exceeded_exception", "reason"=>"bytes can be at most 32766 in length; got 35318"}}}}}
[2018-09-13T20:00:26,213][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"logstash-business-2018-09-13", :_type=>"xiaopeng_datacenter_log", :_routing=>nil}, 2018-09-13T12:00:15.964Z 2bf557d1b15f %{message}], :response=>{"index"=>{"_index"=>"logstash-business-2018-09-13", "_type"=>"xiaopeng_datacenter_log", "_id"=>"AWXSzcHpGNuyXfNUtLUR", "status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"Document contains at least one immense term in field=\"event.keyword\" (whose UTF8 encoding is longer than the max length 32766), all of which were skipped. Please correct the analyzer to not produce such terms. The prefix of the first immense term is: '[114, 111, 111, 116, 58, 32, 100, 98, 99, 101, 110, 116, 101, 114, 45, 62, 77, 111, 98, 105, 108, 101, 95, 109, 111, 100, 101, 108, 45, 62]...', original message: bytes can be at most 32766 in length; got 35318", "caused_by"=>{"type"=>"max_bytes_length_exceeded_exception", "reason"=>"bytes can be at most 32766 in length; got 35318"}}}}}
[2018-09-13T22:24:43,342][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"logstash-business-2018-09-13", :_type=>"xiaopeng_datacenter_log", :_routing=>nil}, 2018-09-13T14:24:36.388Z dtweb01 %{message}], :response=>{"index"=>{"_index"=>"logstash-business-2018-09-13", "_type"=>"xiaopeng_datacenter_log", "_id"=>"AWXTUd6NGNuyXfNU2X7C", "status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"Document contains at least one immense term in field=\"event.keyword\" (whose UTF8 encoding is longer than the max length 32766), all of which were skipped. Please correct the analyzer to not produce such terms. The prefix of the first immense term is: '[114, 111, 111, 116, 58, 32, 116, 105, 100, 95, 67, 112, 67, 104, 97, 110, 110, 101, 108, 83, 121, 110, 99, 95, 99, 104, 97, 116, 49, 53]...', original message: bytes can be at most 32766 in length; got 36667", "caused_by"=>{"type"=>"max_bytes_length_exceeded_exception", "reason"=>"bytes can be at most 32766 in length; got 36667"}}}}}
已邀请:

redhat

赞同来自:

改成text类型 或者限制长度 ignore_above

要回复问题请先登录注册