Logstash日志里频繁出现报错""undefined method `sanitized' "

你好,
我的elk版本是5.6,logstash日志里频繁出现报错""undefined method `sanitized' "

每次,刚开始启动的时候是一切正常的,然后慢慢就会出现下面这种报错,积攒到某一天,就会发现不往elastic里写索引数据了。这时候产看日志每天会有7 、 8 M都是刷这个错误。
然后我重启logstash就看似又恢复正常了!

有没有什么好的解决办法?日志内容如下:

[2018-12-07T06:02:38,323][ERROR][logstash.outputs.elasticsearch] Encountered an unexpected error submitting a bulk request! Will retry. {:error_message=>"undefined method sanitized' for \"http://10.0.67.7:9222/_bulk\":String", :class=>"NoMethodError", :backtrace=>["/rmp/logstash-5.6.1/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-7.4.0-java/lib/logstash/outputs/elasticsearch/common.rb:249:insafe_bulk'", "/rmp/logstash-5.6.1/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-7.4.0-java/lib/logstash/outputs/elasticsearch/common.rb:222:in safe_bulk'", "/rmp/logstash-5.6.1/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-7.4.0-java/lib/logstash/outputs/elasticsearch/common.rb:119:insubmit'", "/rmp/logstash-5.6.1/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-7.4.0-java/lib/logstash/outputs/elasticsearch/common.rb:87:in retrying_submit'", "/rmp/logstash-5.6.1/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-7.4.0-java/lib/logstash/outputs/elasticsearch/common.rb:38:inmulti_receive'", "/rmp/logstash-5.6.1/logstash-core/lib/logstash/output_delegator_strategies/shared.rb:13:in multi_receive'", "/rmp/logstash-5.6.1/logstash-core/lib/logstash/output_delegator.rb:49:inmulti_receive'", "/rmp/logstash-5.6.1/logstash-core/lib/logstash/pipeline.rb:436:in output_batch'", "org/jruby/RubyHash.java:1342:ineach'", "/rmp/logstash-5.6.1/logstash-core/lib/logstash/pipeline.rb:435:in output_batch'", "/rmp/logstash-5.6.1/logstash-core/lib/logstash/pipeline.rb:381:inworker_loop'", "/rmp/logstash-5.6.1/logstash-core/lib/logstash/pipeline.rb:342:in `start_workers'"]}

应该和这个问题是一样的:

你看看是不是配置的用户名权限不够。

我用的超级用户。关键是刚启动会正常运行一段时间~~~~

不是运行的用户,你的 es 有没有设置权限?

您说的是这个吗?
elasticsearch {
hosts => ["10.0.67.7:9222"]
index => "aop-xq-%{+YYYY.MM}"
user => "elastic"
password => "changeme"
}

是的,这里的 elastic 用户是不是权限有问题。

目前检查了一下日志输出,发现了大量垃圾数据,而且一条长达5MB,怀疑是日志太长阻塞的(初始运行正常,一段时间后宕死),先让开发项目组整改了。先排除这个原因再有问题再看吧。

1 Like

基本上所有的agent都配置了超级用户,其他节点没发现类似问题。

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.