Работа filebeat завершилась ошибкой: ERROR [logstash] logstash/async.go:280

Elastic In Your Native Tongue Вопросы на русском языке
1

Failbeat перестал отдавать данные в logstash, в лога failbeat вижу ошибку:

ERROR	[logstash]	logstash/async.go:280	Failed to publish events caused by: write tcp 10.0.10.5:53536->10.0.10.6:5044: wsasend: An existing connection was forcibly closed by the remote host.
panic: reflect.Select: too many cases (max 65536)

В чем может быть проблема, почему останавливается filebeat?

Мой конфиг filebeat:

filebeat.inputs:
- type: filestream
  enabled: true
  paths:
    - C:\logs\GT\xml\*\*.log
  fields_under_root: true
  fields:
    system: xml
    subsystem: GT  
  parsers:
    - multiline:
        type: pattern
        pattern: '^\[[0-9]{4}-[0-9]{2}-[0-9]{2}'
        negate: true
        match: after

- type: filestream
  paths:
    - C:\logs\ERRORS\xml\*\*.log
  fields_under_root: true
  fields:
    system: xml
    subsystem: errors
  parsers:
    - multiline:
        type: pattern
        pattern: '^\[[0-9]{4}-[0-9]{2}-[0-9]{2}'
        negate: true
        match: after

filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false

setup.template.settings:
  index.number_of_shards: 1
  
tags: [xmlgate]

output.logstash:
  hosts: ["10.0.10.6:5044"]
  template.name: "xmlgate"
  template.path: "filebeat.template.json"
  template.overwrite: false

logging.metrics.enabled: false
2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.