解决filebeat+es+kibana做错误日志收集的一个问题

Posted 2021-03-04 HWll

某天发现项目的kibana网页莫名其妙访问不了了

进入linux系统发现kibana进程没了，于是开始重启，发现重启的极其慢

进入控制台，发现索引报了一个错

Index lifecycle error
cluster_block_exception: index [java-error-log-pengye-000011] blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];index [java-error-log-pengye-000012] blocked by:
 [FORBIDDEN/12/index read-only / allow delete (api)];index [java-error-log-pengye-000013] blocked by: 
[FORBIDDEN/12/index read-only / allow delete (api)];index [java-error-log-pengye-000014] blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];

 

查网上说是  设置 "blocks.read_only_allow_delete":"false"  可以解决

可是我看该索引的这个属性是false

 

 ***************************************

还有个是与磁盘空间有关，于是df -h查看了下存储空间

 

占用94%

查看官方文档  https://www.elastic.co/guide/en/elasticsearch/reference/current/disk-allocator.html

设置cluster.routing.allocation.disk.watermark.flood_stage ：99%

重启es，这次启动只用了几秒，解决