1

我正在使用带有 elestic search 和 kibana 的 logstash 来挖掘我的日志。直到昨天它工作正常,但突然开始出现以下错误,我无法理解 -

No results There were no results because no indices were found that match your selected time span

logstash 日志包含以下信息

    {:timestamp=>"2013-12-19T17:32:47.612000+0530", :message=>"Using milestone 2 input plugin 'file'. This plugin should be stable, but if you see strange behavior, please let us know! For more inform$
{:timestamp=>"2013-12-19T17:32:47.728000+0530", :message=>"You are using a deprecated config setting \"type\" set in multiline. Deprecated settings will continue to work, but are scheduled for rem$
{:timestamp=>"2013-12-19T17:32:47.781000+0530", :message=>"You are using a deprecated config setting \"type\" set in grok. Deprecated settings will continue to work, but are scheduled for removal $
{:timestamp=>"2013-12-19T17:32:47.839000+0530", :message=>"You are using a deprecated config setting \"type\" set in date. Deprecated settings will continue to work, but are scheduled for removal $
Exception in thread "LogStash::Runner" org.jruby.exceptions.RaiseException: (EADDRINUSE) Address already in use - bind - Address already in use
        at org.jruby.ext.socket.RubyTCPServer.initialize(org/jruby/ext/socket/RubyTCPServer.java:118)
        at org.jruby.RubyIO.new(org/jruby/RubyIO.java:852)
        at RUBY.initialize(jar:file:/u001/logparser/tools/logstash/logstash-1.3.1-flatjar.jar!/ftw/server.rb:50)
        at org.jruby.RubyArray.each(org/jruby/RubyArray.java:1613)
        at RUBY.initialize(jar:file:/u001/logparser/tools/logstash/logstash-1.3.1-flatjar.jar!/ftw/server.rb:46)
        at org.jruby.RubyArray.each(org/jruby/RubyArray.java:1613)
        at RUBY.initialize(jar:file:/u001/logparser/tools/logstash/logstash-1.3.1-flatjar.jar!/ftw/server.rb:34)
        at RUBY.run(file:/u001/logparser/tools/logstash/logstash-1.3.1-flatjar.jar!/rack/handler/ftw.rb:94)
        at RUBY.run(file:/u001/logparser/tools/logstash/logstash-1.3.1-flatjar.jar!/logstash/kibana.rb:101)
4

1 回答 1

1

来到logstash响应:您将通过logstash保存数据的弹性搜索路径的索引一直拒绝获取数据。由于一次又一次地重复命中相同的查询,这使得 java 应用程序在同一时刻命中相同的端口。因此它停止logstash应用程序并显示绑定问题。

来到kibana响应:检查elasticsearch中的映射和索引名称和模式,它试图保存数据而kibana试图获取数据

如果您在弹性搜索中安装了头插件,则可以在启动弹性搜索服务中看到索引

bin/elasticsearch -f 然后从您的浏览器

http://elasticsearchinstalledip:9201/_plugin/head
于 2013-12-21T11:17:22.197 回答