# Configuracion logstash para indexar en un cluster elasticsearch
**URL:** https://discuss.elastic.co/t/configuracion-logstash-para-indexar-en-un-cluster-elasticsearch/32496
**Category:** Elastic en Español
**Created:** [October 19, 2015, 2:51pm UTC](https://discuss.elastic.co/t/configuracion-logstash-para-indexar-en-un-cluster-elasticsearch/32496 "2015-10-19T14:51:06Z")
**Posts on this page:** 13
**Page:** 1
### Author:  [@Emiliano\_Baum](https://discuss.elastic.co/u/Emiliano_Baum)
#### Post date: [October 19, 2015, 2:51pm UTC](https://discuss.elastic.co/t/configuracion-logstash-para-indexar-en-un-cluster-elasticsearch/32496/1 "2015-10-19T14:51:06Z")
Hola, tengo funcionando finalmente un cluster ES y varias instancias de logstash almacenando datos en el. Sin embargo, con una de las instancias me surge un inconveniente que no logro resolver.
El error que me indica es :
message=\>"failed action with response of 400, dropping action:
la config en logstash es:
output {
elasticsearch {
protocol =\> "http"
host =\> "10.0.100.28"
port =\> 9200
cluster =\> "G-MC-ES-CLUSTER-01"
index =\> "z1\_crt\_ifmodulatortableA-%{+YYYY.MM.dd}"
}
}
Lo extraño es que las otras instancias tienen una configuracion similar y no presentan errores.
Desde ya muchas gracias, Emiliano
---
### Author:  [@Camilo\_Sierra](https://discuss.elastic.co/u/Camilo_Sierra)
#### Post date: [October 19, 2015, 2:53pm UTC](https://discuss.elastic.co/t/configuracion-logstash-para-indexar-en-un-cluster-elasticsearch/32496/2 "2015-10-19T14:53:31Z")
y viste los logs de Elasicsearch ? los detalles del problema sera en los logs ES
---
### Author:  [@Emiliano\_Baum](https://discuss.elastic.co/u/Emiliano_Baum)
#### Post date: [October 19, 2015, 2:58pm UTC](https://discuss.elastic.co/t/configuracion-logstash-para-indexar-en-un-cluster-elasticsearch/32496/3 "2015-10-19T14:58:42Z")
Nada en lo logs del ES cliente, que es quien recibiria los datos:
[2015-10-19 14:57:26,415][INFO][node] [G-ES-CLIENT-01] stopping ...
[2015-10-19 14:57:26,482][INFO][node] [G-ES-CLIENT-01] stopped
[2015-10-19 14:57:26,482][INFO][node] [G-ES-CLIENT-01] closing ...
[2015-10-19 14:57:26,493][INFO][node] [G-ES-CLIENT-01] closed
[2015-10-19 14:57:28,784][INFO][node] [G-ES-CLIENT-01] version[1.7.2], pid[6943], build[e43676b/2015-09-14T09:49:53Z]
[2015-10-19 14:57:28,784][INFO][node] [G-ES-CLIENT-01] initializing ...
[2015-10-19 14:57:28,970][INFO][plugins] [G-ES-CLIENT-01] loaded [], sites [kopf, head, bigdesk]
[2015-10-19 14:57:33,563][INFO][node] [G-ES-CLIENT-01] initialized
[2015-10-19 14:57:33,563][INFO][node] [G-ES-CLIENT-01] starting ...
[2015-10-19 14:57:33,933][INFO][transport] [G-ES-CLIENT-01] bound\_address {inet[/10.0.100.28:9300]}, publish\_address {inet[/10.0.100.28:9300]}
[2015-10-19 14:57:33,962][INFO][discovery] [G-ES-CLIENT-01] G-MC-ES-CLUSTER-01/g9gyPBZcTHGky8oeG4sCeQ
[2015-10-19 14:57:37,170][INFO][cluster.service] [G-ES-CLIENT-01] detected\_master [G-ES-MASTER-01][kmoGxVcrS3ur\_Cdn0vVMuA][G-ES-MASTER-01][inet[/10.0.100.26:9300]]{data=false, master=true}, added {[G-ES-DATA-01][dmEwM-4fRs2CpgfP4ZmblA][G-ES-DATA-01][inet[/10.0.100.23:9300]]{master=false},[G-ES-DATA-02][lG-nK9SKQqegL4RHg73NHQ][G-ES-DATA-02][inet[/10.0.100.25:9300]]{master=false},[G-ES-MASTER-01][kmoGxVcrS3ur\_Cdn0vVMuA][G-ES-MASTER-01][inet[/10.0.100.26:9300]]{data=false, master=true},}, reason: zen-disco-receive(from master [[G-ES-MASTER-01][kmoGxVcrS3ur\_Cdn0vVMuA][G-ES-MASTER-01][inet[/10.0.100.26:9300]]{data=false, master=true}])
[2015-10-19 14:57:37,230][INFO][http] [G-ES-CLIENT-01] bound\_address {inet[/10.0.100.28:9200]}, publish\_address {inet[/10.0.100.28:9200]}
[2015-10-19 14:57:37,230][INFO][node] [G-ES-CLIENT-01] started
---
### Author:  [@Camilo\_Sierra](https://discuss.elastic.co/u/Camilo_Sierra)
#### Post date: [October 19, 2015, 2:59pm UTC](https://discuss.elastic.co/t/configuracion-logstash-para-indexar-en-un-cluster-elasticsearch/32496/4 "2015-10-19T14:59:48Z")
no mira en el ES data porque lo mas probable es que sea un problema con el mapping !
---
### Author:  [@Emiliano\_Baum](https://discuss.elastic.co/u/Emiliano_Baum)
#### Post date: [October 19, 2015, 3:12pm UTC](https://discuss.elastic.co/t/configuracion-logstash-para-indexar-en-un-cluster-elasticsearch/32496/5 "2015-10-19T15:12:37Z")
No, en el ES Data no encontre ningun error en referencia a ese hilo.
Lo que si pude ver que en las otras intancias de logstash aparecen aleatoriamente algunos errores similares:
:message=\>"failed action with response of 400, dropping action:
Pero no son permanentes como en el caso que mencionaba antes....
seguire buscando a ver que sale
---
### Author:  [@Camilo\_Sierra](https://discuss.elastic.co/u/Camilo_Sierra)
#### Post date: [October 19, 2015, 3:21pm UTC](https://discuss.elastic.co/t/configuracion-logstash-para-indexar-en-un-cluster-elasticsearch/32496/6 "2015-10-19T15:21:59Z")
Ya me ha occurrido varias veces el mismo problema, y la mayoria de las veces es poblemas con el mapping sobre todo con las fechas (formato...)
espero que puedas conseguir los logs para poder ayudarte!
---
### Author:  [@gmoskovicz](https://discuss.elastic.co/u/gmoskovicz)
#### Post date: [October 19, 2015, 3:28pm UTC](https://discuss.elastic.co/t/configuracion-logstash-para-indexar-en-un-cluster-elasticsearch/32496/7 "2015-10-19T15:28:54Z")
Si mal entiendo, el index tiene mayusculas, y esto puede causar un invalid request del lado de Elasticsearch.
```auto
POST ejemploA
```
Response:
```auto
{
"error": "InvalidIndexNameException[[ejemploA] Invalid index name [ejemploA], must be lowercase]",
"status": 400
}
```
Cambiando tu configuracion:
```auto
output {
elasticsearch {
protocol => "http"
host => "10.0.100.28"
port => 9200
cluster => "G-MC-ES-CLUSTER-01"
index => "z1_crt_ifmodulatortableA-%{+YYYY.MM.dd}"
}
}
```
`z1_crt_ifmodulatortableA-%{+YYYY.MM.dd}` por `z1_crt_ifmodulatortablea-%{+YYYY.MM.dd}` resolveria posiblemente el problema.
Saludos!
--Gabriel
---
### Author:  [@Camilo\_Sierra](https://discuss.elastic.co/u/Camilo_Sierra)
#### Post date: [October 19, 2015, 3:34pm UTC](https://discuss.elastic.co/t/configuracion-logstash-para-indexar-en-un-cluster-elasticsearch/32496/8 "2015-10-19T15:34:21Z")
Gabriel pero una preguna porque razon este error no apareceria en los logs? lo unico raro es que no sale como un error pero en TYPE [debug] ...
```
2015-10-19 17:29:45,644][DEBUG][action.admin.indices.create] [Harpoon] [Hello] failed to create
org.elasticsearch.indices.InvalidIndexNameException: [Hello] Invalid index name [Hello], must be lowercase
at org.elasticsearch.cluster.metadata.MetaDataCreateIndexService.validateIndexName(MetaDataCreateIndexService.java:175)
```
---
### Author:  [@gmoskovicz](https://discuss.elastic.co/u/gmoskovicz)
#### Post date: [October 19, 2015, 3:45pm UTC](https://discuss.elastic.co/t/configuracion-logstash-para-indexar-en-un-cluster-elasticsearch/32496/9 "2015-10-19T15:45:31Z")
> [@Emiliano\_Baum](#):
>
> [INFO]
El nivel de error para este tipo de errores es `DEBUG` mientras que pareceria que aqui solo tiene activado el nivel INFO como minimo.
Saludos
---
### Author:  [@gmoskovicz](https://discuss.elastic.co/u/gmoskovicz)
#### Post date: [October 19, 2015, 3:48pm UTC](https://discuss.elastic.co/t/configuracion-logstash-para-indexar-en-un-cluster-elasticsearch/32496/10 "2015-10-19T15:48:32Z")
Por defecto, de todas maneras, deberia de aparecer en los logs:
```auto
[2015-10-19 12:47:42,592][INFO][node] [Jacob "Jake" Fury] initialized
[2015-10-19 12:47:42,593][INFO][node] [Jacob "Jake" Fury] starting ...
[2015-10-19 12:47:42,651][INFO][transport] [Jacob "Jake" Fury] bound_address {inet[/0:0:0:0:0:0:0:0:9300]}, publish_address {inet[/192.168.1.100:9300]}
[2015-10-19 12:47:42,664][INFO][discovery] [Jacob "Jake" Fury] elasticsearch/rAyodreBTcW7M-lVj6Oe4A
[2015-10-19 12:47:46,442][INFO][cluster.service] [Jacob "Jake" Fury] new_master [Jacob "Jake" Fury][rAyodreBTcW7M-lVj6Oe4A][Gabriels-MacBook-Pro.local][inet[/192.168.1.100:9300]], reason: zen-disco-join (elected_as_master)
[2015-10-19 12:47:46,483][INFO][http] [Jacob "Jake" Fury] bound_address {inet[/0:0:0:0:0:0:0:0:9200]}, publish_address {inet[/192.168.1.100:9200]}
[2015-10-19 12:47:46,483][INFO][node] [Jacob "Jake" Fury] started
[2015-10-19 12:47:46,501][INFO][cluster.routing.allocation.decider] [Jacob "Jake" Fury] updating [cluster.routing.allocation.disable_allocation] from [false] to [true]
[2015-10-19 12:47:46,535][INFO][gateway] [Jacob "Jake" Fury] recovered [6] indices into cluster_state
[2015-10-19 12:47:52,912][INFO][cluster.metadata] [Jacob "Jake" Fury] [.marvel-2015.10.19] update_mapping [cluster_event] (dynamic)
[2015-10-19 12:47:52,924][INFO][cluster.metadata] [Jacob "Jake" Fury] [.marvel-2015.10.19] update_mapping [node_event] (dynamic)
[2015-10-19 12:48:07,793][DEBUG][action.admin.indices.create] [Jacob "Jake" Fury] [ejemploA] failed to create
org.elasticsearch.indices.InvalidIndexNameException: [ejemploA] Invalid index name [ejemploA], must be lowercase
at org.elasticsearch.cluster.metadata.MetaDataCreateIndexService.validateIndexName(MetaDataCreateIndexService.java:175)
at org.elasticsearch.cluster.metadata.MetaDataCreateIndexService.validate(MetaDataCreateIndexService.java:551)
at org.elasticsearch.cluster.metadata.MetaDataCreateIndexService.access$200(MetaDataCreateIndexService.java:88)
at org.elasticsearch.cluster.metadata.MetaDataCreateIndexService$2.execute(MetaDataCreateIndexService.java:230)
at org.elasticsearch.cluster.service.InternalClusterService$UpdateTask.run(InternalClusterService.java:374)
at org.elasticsearch.common.util.concurrent.PrioritizedEsThreadPoolExecutor$TieBreakingPrioritizedRunnable.runAndClean(PrioritizedEsThreadPoolExecutor.java:196)
at org.elasticsearch.common.util.concurrent.PrioritizedEsThreadPoolExecutor$TieBreakingPrioritizedRunnable.run(PrioritizedEsThreadPoolExecutor.java:162)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
at java.lang.Thread.run(Thread.java:745)
```
---
### Author:  [@Emiliano\_Baum](https://discuss.elastic.co/u/Emiliano_Baum)
#### Post date: [October 19, 2015, 4:38pm UTC](https://discuss.elastic.co/t/configuracion-logstash-para-indexar-en-un-cluster-elasticsearch/32496/11 "2015-10-19T16:38:02Z")
Tenia razon @gmoskovicz, cambie el nombre al indice y funciono. Lo raro que de todos los errores en los logs que encontre ninguno me hubiera llevado a eso.
En relacion al nivel de log esta en debug:
[2015-10-19 12:53:04,696][DEBUG][action.bulk] [G-ES-DATA-01] [inu08-2015.10.19][1] failed to execute bulk item (index) index {[inu08-2015.10.19][logs][AVCAKSI8httCSkMDGyV8], source[{"message":["3499463;1743481;0;228798;falling;METOP-B;NRZ-L;2015-10-19T11:51:47;0000-00-00T00:00:00;FINISHED"],"@version":"1","@timestamp":"2015-10-19T12:52:53.509Z","host":"10.0.100.27","iClkFreq":3499463.0,"iDataFreq":1743481.0,"iRxTotalBytes":0.0,"iUSBRate":228798.0,"sClkSample":0.0,"sFileName":"METOP-B","sLineCode":"NRZ-L","sStartTime":"2015-10-19T11:51:47","sStopTime":"0000-00-00T00:00:00","sUnitStatus":"FINISHED"}]}
org.elasticsearch.index.mapper.MapperParsingException: failed to parse [sStopTime]
e
Bueno, de todas formas salio andando... saben en que parte del manual podria encontrar este tipo de especificaciones acerca del formato de nombres permitidos para los indices o problemas similares que pudieran surgir??? La verdad es que no los encontre o los pase por alto.
Muchisimas gracias!
Slds, Emiliano
---
### Author:  [@gmoskovicz](https://discuss.elastic.co/u/gmoskovicz)
#### Post date: [October 19, 2015, 4:50pm UTC](https://discuss.elastic.co/t/configuracion-logstash-para-indexar-en-un-cluster-elasticsearch/32496/12 "2015-10-19T16:50:42Z")
Puedes navegar en nuestra documentacion pero no tenemos ningun manual especifico de formatos.
En cuanto al DEBUG, puede que unicamente este activado el DEBUG para action.bulk yo no el generico, y ademas deberias de buscar en el host al que se le envia el BULK request para asegurarse, pero efectivamente activado el DEBUG generico deberia de aparecer.
Saludos!
--Gabriel
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 1:50pm UTC](https://discuss.elastic.co/t/configuracion-logstash-para-indexar-en-un-cluster-elasticsearch/32496/13 "2017-07-06T13:50:55Z")