Logstash日志里频繁出现报错""undefined method `sanitized' "

Elastic In Your Native Tongue 中文提问与讨论
1

你好，
我的elk版本是5.6，logstash日志里频繁出现报错""undefined method `sanitized' "

每次，刚开始启动的时候是一切正常的，然后慢慢就会出现下面这种报错，积攒到某一天，就会发现不往elastic里写索引数据了。这时候产看日志每天会有7 、 8 M都是刷这个错误。
然后我重启logstash就看似又恢复正常了！

有没有什么好的解决办法？日志内容如下：

[2018-12-07T06:02:38,323][ERROR][logstash.outputs.elasticsearch] Encountered an unexpected error submitting a bulk request! Will retry. {:error_message=>"undefined method sanitized' for \"http://10.0.67.7:9222/_bulk\":String", :class=>"NoMethodError", :backtrace=>["/rmp/logstash-5.6.1/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-7.4.0-java/lib/logstash/outputs/elasticsearch/common.rb:249:insafe_bulk'", "/rmp/logstash-5.6.1/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-7.4.0-java/lib/logstash/outputs/elasticsearch/common.rb:222:in safe_bulk'", "/rmp/logstash-5.6.1/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-7.4.0-java/lib/logstash/outputs/elasticsearch/common.rb:119:insubmit'", "/rmp/logstash-5.6.1/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-7.4.0-java/lib/logstash/outputs/elasticsearch/common.rb:87:in retrying_submit'", "/rmp/logstash-5.6.1/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-7.4.0-java/lib/logstash/outputs/elasticsearch/common.rb:38:inmulti_receive'", "/rmp/logstash-5.6.1/logstash-core/lib/logstash/output_delegator_strategies/shared.rb:13:in multi_receive'", "/rmp/logstash-5.6.1/logstash-core/lib/logstash/output_delegator.rb:49:inmulti_receive'", "/rmp/logstash-5.6.1/logstash-core/lib/logstash/pipeline.rb:436:in output_batch'", "org/jruby/RubyHash.java:1342:ineach'", "/rmp/logstash-5.6.1/logstash-core/lib/logstash/pipeline.rb:435:in output_batch'", "/rmp/logstash-5.6.1/logstash-core/lib/logstash/pipeline.rb:381:inworker_loop'", "/rmp/logstash-5.6.1/logstash-core/lib/logstash/pipeline.rb:342:in `start_workers'"]}

2

应该和这个问题是一样的：

你看看是不是配置的用户名权限不够。

3

我用的超级用户。关键是刚启动会正常运行一段时间~~~~

4

不是运行的用户，你的 es 有没有设置权限？

5

您说的是这个吗？
elasticsearch {
hosts => ["10.0.67.7:9222"]
index => "aop-xq-%{+YYYY.MM}"
user => "elastic"
password => "changeme"
}

6

是的，这里的 elastic 用户是不是权限有问题。

7

目前检查了一下日志输出，发现了大量垃圾数据，而且一条长达5MB，怀疑是日志太长阻塞的（初始运行正常，一段时间后宕死），先让开发项目组整改了。先排除这个原因再有问题再看吧。

1 Like
8

基本上所有的agent都配置了超级用户，其他节点没发现类似问题。

9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.