Pipeline/output.go:121 Failed to publish events: temporary bulk send failure

[icirco]

hi,

I have my filebeat agent (7.4) is still running but it stop to fill index.

In my log, I see the message :
pipeline/output.go:121 Failed to publish events: temporary bulk send failure

I try to change the bulk_max_size in filebeat.yml with no effect....

  bulk_max_size: 10240
  max_retries: 12

any idea ?

[Ogi_Sigit_P (Ogi Sigit Pornawan)]

I have the same problem.
It used to works well for a few months, and suddendly this error come up.

Blockquote
2020-09-05T05:42:20.388Z INFO template/load.go:169 Existing template will be overwritten, as overwrite is enabled.

2020-09-05T05:42:20.390Z INFO template/load.go:109 Try loading template filebeat-7.7.1 to Elasticsearch

2020-09-05T05:42:20.425Z INFO template/load.go:101 template with name 'filebeat-7.7.1' loaded.

2020-09-05T05:42:20.426Z INFO [index-management] idxmgmt/std.go:295 Loaded index template.

2020-09-05T05:42:20.426Z INFO [index-management] idxmgmt/std.go:306 Write alias successfully generated.

2020-09-05T05:42:20.426Z INFO [publisher_pipeline_output] pipeline/output.go:111 Connection to backoff(elasticsearch(http://----:9200)) established

2020-09-05T05:42:20.426Z INFO [publisher] pipeline/retry.go:196 retryer: send unwait-signal to consumer

2020-09-05T05:42:20.427Z INFO [publisher] pipeline/retry.go:198 done

2020-09-05T05:42:20.428Z INFO [publisher] pipeline/retry.go:173 retryer: send wait signal to consumer

2020-09-05T05:42:20.428Z INFO [publisher] pipeline/retry.go:175 done

2020-09-05T05:42:21.472Z ERROR [publisher_pipeline_output] pipeline/output.go:127 Failed to publish events: temporary bulk send failure

2020-09-05T05:42:21.472Z INFO [publisher_pipeline_output] pipeline/output.go:101 Connecting to backoff(elasticsearch(http://----:9200))