Hey guys,
I can't seem to use Logstash with ES Shield. I set this up on my test instances, because I'll be expected to make this work on the company setup this coming week. So lessons learned here will apply there.
It seems that the ES nodes can all talk to one another and nodes all are showing up in the ES kopf plugin.
But since starting up Logstash I have this message repeating in the logs:
{:timestamp=>"2015-07-12T20:23:02.764000-0400", :message=>"Failed to flush outgoing items", :outgoing_count=>1, :exception=>org.elasticsearch.cluster.block.ClusterBlockException: blocked by: [SERVICE_UNAVAILABLE/1/state not recovered / initialized];[SERVICE_UNAVAILABLE/2/no master];, :backtrace=>["org.elasticsearch.cluster.block.ClusterBlocks.globalBlockedException(org/elasticsearch/cluster/block/ClusterBlocks.java:151)", "org.elasticsearch.cluster.block.ClusterBlocks.globalBlockedRaiseException(org/elasticsearch/cluster/block/ClusterBlocks.java:141)", "org.elasticsearch.action.bulk.TransportBulkAction.executeBulk(org/elasticsearch/action/bulk/TransportBulkAction.java:210)", "org.elasticsearch.action.bulk.TransportBulkAction.access$000(org/elasticsearch/action/bulk/TransportBulkAction.java:73)", "org.elasticsearch.action.bulk.TransportBulkAction$1.onFailure(org/elasticsearch/action/bulk/TransportBulkAction.java:148)", "org.elasticsearch.action.support.TransportAction$ThreadedActionListener$2.run(org/elasticsearch/action/support/TransportAction.java:137)", "java.util.concurrent.ThreadPoolExecutor.runWorker(java/util/concurrent/ThreadPoolExecutor.java:1142)", "java.util.concurrent.ThreadPoolExecutor$Worker.run(java/util/concurrent/ThreadPoolExecutor.java:617)", "java.lang.Thread.run(java/lang/Thread.java:745)"], :level=>:warn}
And I also see this error:
{:timestamp=>"2015-07-12T20:28:40.917000-0400", :message=>"Got error to send bulk of actions: blocked by: [SERVICE_UNAVAILABLE/1/state not recovered / initialized];[SERVICE_UNAVAILABLE/2/no master];", :level=>:error}
Here's how I have the output configured in Logstash:
output {
elasticsearch {
protocol => 'http'
host => 'localhost'
user => 'ls_admin'
password => 'secretsauce'
index => 'logstash-%{+YYYY.MM.dd}'
}
stdout { codec => rubydebug }
}
I was able to create an index in LS by running it on the command line using this command:
logstash -e 'input { stdin { } } output { elasticsearch {protocol => http user => admin password => secretsauce host => localhost } }'
But, like I said, using the output I have in the file, I get the error I mention above. And even if I take that command line I just showed you and stash it in a file I get the same error. What the blinkin' hell...?
