可以使用 is_write_index=false 显式禁用索引

Question

日志未发布且 filebeat 显示在警告下方

2023-08-07T12:06:32.359Z WARN [elasticsearch] elasticsearch/client.go:414 Cannot index event publisher.Event...
.
.
.
{"type":"illegal_argument_exception","reason":"no write index is defined for alias [filebeat-7.17.1]. The write index may be explicitly disabled using is_write_index=false or the alias points to multiple indices without one being designated as a write index"}, dropping event!

解决方案是什么

Answer 1

当一段时间后在索引模式中推送到最新索引出现异常时，该索引将通过参数 is_write_index=false

屏蔽为暂停

我们需要通过将参数值设置为true

来删除该锁

1. 登录 Kibana 门户
2. 转到管理部分下的开发工具

粘贴以下代码并更新索引名称和别名

POST /_aliases
{
"actions" : [
    {
        "add" : {
             "index" : "<index_name>",
             "alias" : "<alias_name>",
             "is_write_index" : true
        }
    }
  ]
}

注意：别名将以

filebeat- 开头

官方文档：

https://www.elastic.co/guide/en/elasticsearch/reference/7.5/indices-aliases.html#aliases-write-index

一旦执行上述操作，日志就会开始推送到索引