1. 通过logstash6.8采集oracle ash表数据输出到ES 错误，信息如下：
[ERROR][logstash.outputs.elasticsearch] Encountered a retryable error. Will Retry with exponential backoff {:code=>403, :url=>"http://appServer:9200/_bulk"}
[ERROR][logstash.outputs.elasticsearch] Encountered a retryable error. Will Retry with exponential backoff {:code=>403, :url=>"http://appServer:9200/_bulk"}
7 个回复
liuxg - Elastic
赞同来自: albin
albin
赞同来自:
input {
jdbc {
jdbc_driver_library => "/ups/app/logstash/ojdbc8.jar"
jdbc_driver_class => "Java::oracle.jdbc.driver.OracleDriver"
jdbc_connection_string => "jdbc:oracle:thin:@192.168.10.181:1522/o11g"
jdbc_user => "orcl"
jdbc_password => "password"
# parameters => { "ddtime" => "sysdate - 2" }
schedule => "*/2 * * * *"
statement => "SELECT * FROM V$ACTIVE_SESSION_HISTORY WHERE SAMPLE_TIME > :sql_last_value"
last_run_metadata_path => "/tmp/logstash-o11g-ash.lastrun"
record_last_run => true
}
}
output {
stdout { codec => rubydebug }
elasticsearch {
hosts => [ "localhost:9200" ]
user => "logstash_system"
password => "123456"
index => "oracle-%{+YYYYMMdd}"
}
}
-- 启动
./bin/logstash -f config/logstash-ash.conf --config.reload.automatic
liuxg - Elastic
赞同来自:
this seems to be caused by ES rejecting a bulk request due to it being larger than http.max_content_length after being uncompressed.
上面的说法是可以尝试修改http.max_content_length来得到解决
albin
赞同来自:
.......
{
"sample_time" => "2019-11-13T02:36:07.762Z",
"sample_id" => 732230.0,
"@version" => "1",
"@timestamp" => 2019-11-13T02:36:07.762Z
}
{
"sample_time" => "2019-11-13T02:36:04.762Z",
"sample_id" => 732227.0,
"@version" => "1",
"@timestamp" => 2019-11-13T02:36:04.762Z
}
[2019-11-13T14:36:03,463][ERROR][logstash.outputs.elasticsearch] Encountered a retryable error. Will Retry with exponential backoff {:code=>403, :url=>"http://192.168.10.151:9200/_bulk"}
[2019-11-13T14:36:05,396][ERROR][logstash.outputs.elasticsearch] Encountered a retryable error. Will Retry with exponential backoff {:code=>403, :url=>"http://192.168.10.151:9200/_bulk"}
albin
赞同来自:
user => "logstash_system" >>>改成 user => "elastic"
}
这样修改就可以了
liuxg - Elastic
赞同来自:
Clannd
赞同来自: