找到问题的解决办法了么?

通过jdbc获取oracle中ash表数据到ES出错

Logstash | 作者 albin | 发布于2019年11月13日 | 阅读数:148

1. 通过logstash6.8采集oracle ash表数据输出到ES 错误,信息如下:
[ERROR][logstash.outputs.elasticsearch] Encountered a retryable error. Will Retry with exponential backoff {:code=>403, :url=>"http://appServer:9200/_bulk"}
已邀请:

liuxg - Elastic

赞同来自: albin

The 403 error indicates a permission problem. Make sure the user used by Logstash has sufficient permissions in Elasticsearch. I don't think this is related to the JNA library problem but you'll probably want to solve that anyway so I'd start there.

albin

赞同来自:

vi logstash-ash.conf
input {
    jdbc {
        jdbc_driver_library => "/ups/app/logstash/ojdbc8.jar"
        jdbc_driver_class => "Java::oracle.jdbc.driver.OracleDriver"
        jdbc_connection_string => "jdbc:oracle:thin:@192.168.10.181:1522/o11g"
        jdbc_user => "orcl"
        jdbc_password => "password"
        # parameters => { "ddtime" => "sysdate - 2" }
        schedule => "*/2 * * * *"
        statement => "SELECT * FROM V$ACTIVE_SESSION_HISTORY WHERE SAMPLE_TIME > :sql_last_value"
        last_run_metadata_path => "/tmp/logstash-o11g-ash.lastrun"
        record_last_run => true
    }
}
output {
    stdout { codec => rubydebug }
    elasticsearch {
        hosts => [ "localhost:9200" ]
        user => "logstash_system"
        password => "123456"
        index => "oracle-%{+YYYYMMdd}"
    }
}
 
-- 启动
./bin/logstash -f config/logstash-ash.conf --config.reload.automatic

liuxg - Elastic

赞同来自:

你可以看一下这个问题https://github.com/logstash-pl ... s/823
this seems to be caused by ES rejecting a bulk request due to it being larger than http.max_content_length after being uncompressed.
上面的说法是可以尝试修改http.max_content_length来得到解决

albin

赞同来自:

在elasticsearch.yml文件中配置http.max_content_length参数后重启ES服务并修改logstash-ash.conf语句再启动logstash采集数据。但还是错误,logstash输出如下:
.......
{
    "sample_time" => "2019-11-13T02:36:07.762Z",
      "sample_id" => 732230.0,
       "@version" => "1",
     "@timestamp" => 2019-11-13T02:36:07.762Z
}
{
    "sample_time" => "2019-11-13T02:36:04.762Z",
      "sample_id" => 732227.0,
       "@version" => "1",
     "@timestamp" => 2019-11-13T02:36:04.762Z
}
[2019-11-13T14:36:03,463][ERROR][logstash.outputs.elasticsearch] Encountered a retryable error. Will Retry with exponential backoff  {:code=>403, :url=>"http://192.168.10.151:9200/_bulk"}
[2019-11-13T14:36:05,396][ERROR][logstash.outputs.elasticsearch] Encountered a retryable error. Will Retry with exponential backoff  {:code=>403, :url=>"http://192.168.10.151:9200/_bulk"}
 

albin

赞同来自:

将elasticsearch{ 
     user => "logstash_system"      >>>改成  user => "elastic"     
}
 
这样修改就可以了

liuxg - Elastic

赞同来自:

恭喜!

要回复问题请先登录注册