elk报错及解决方案总结

es集群报错
指导文章 http://www.cnblogs.com/reblue520/p/6972138.html
1.字段超长
[2017-08-02T00:00:03,182][DEBUG][o.e.a.b.TransportShardBulkAction] [node3] [gzq-rest07-notify-2017-08-01][3] failed to execute bulk item (index) index
java.lang.IllegalArgumentException: Document contains at least one immense term in field="message" (whose UTF8 encoding is longer than the max length 32766)
该报错只出现于工作圈的日志中
目前解决尝试的方法 http://rockybean.info/2015/02/09/elasticsearch-immense-term-exception
2.进程占满
[2017-08-03T08:01:56,086][DEBUG][o.e.a.b.TransportShardBulkAction] [node3] [bro-conn-log-2017-08-03][0] failed to execute bulk item (index) index {[bro-conn-log-2017-08-03]
org.elasticsearch.cluster.metadata.ProcessClusterEventTimeoutException: failed to process cluster event (put-mapping) within 30s
计划尝试的方法 http://blog.csdn.net/ypc123ypc/article/details/69945031
3.连接超时
[2017-08-04T06:09:11,571][WARN ][o.e.m.j.JvmGcMonitorService] [node1] [gc][68115] overhead, spent [571ms] collecting in the last [1s]
4.内存不足
[2017-08-05T06:52:29,940][ERROR][o.e.b.ElasticsearchUncaughtExceptionHandler] [node6] fatal error in thread [elasticsearch[node6][generic][T#375]], exiting
java.lang.OutOfMemoryError: Java heap space
5.节点脱离集群
[2017-08-08T10:33:22,537][WARN ][r.suppressed ] path: /x3-router*-2017-06-09, params: {index=x3-router*-2017-06-09}
org.elasticsearch.transport.RemoteTransportException: [node11][10.20.3.25:19300][indices:admin/delete]
6.创建索引失败
[2017-08-10T09:10:43,664][DEBUG][o.e.a.a.i.m.p.TransportPutMappingAction] [node10-rep1] failed to put mappings on indices [[[db-postgresql-2017-08-10/AkH1cVBCSLewd_Vki--vaA]]], type [logs]




logstash 报错
[2017-08-03T14:13:10,613][ERROR][logstash.outputs.elasticsearch] Action
原因：因为有大量的未分配的分片堆积 导致新的索引不能正常的分配到各个数据节点，使得所有的数据请求都发送到一台相同的服务器上，导致通道阻塞，不能正常发送数据
解决方法：使用10.17.4.247上的脚本进行未分配的分片重新分配，然后重新发送数据 http://aishu.iteye.com/blog/2363208
[2017-08-03T14:13:34,708][WARN ][logstash.filters.grok    ] Timeout executing grok
计划尝试的方法 http://blog.csdn.net/ypc123ypc/article/details/69945031