wonglend

另外 log-pilot POD的 /var/log/filebeat/filebeat 日志出现： ` 2020-06-23T11:28:37+08:00 ERR Failed to connect: Connection marked as failed because the onConnect callback failed: Error loading Elasticsearch template: could not load template: couldn't load...

> 看es日志，貌似是htpps引起的 > {"type": "server", "timestamp": "2020-06-23T03:21:06,009Z", "level": "WARN", "component": "o.e.x.s.t.n.SecurityNetty4HttpServerTransport", "cluster.name": "elastic", "node.name": "elastic-es-default-0", "message": "received plaintext http traffic on an https channel, closing connection Netty4HttpChannel{localAddress=/100.65.11.6:9200, remoteAddress=/100.65.11.8:43002}", "cluster.uuid": "blyc_Ps6QNiS-U3iMLh88g",...

> 看es日志，貌似是htpps引起的 > {"type": "server", "timestamp": "2020-06-23T03:21:06,009Z", "level": "WARN", "component": "o.e.x.s.t.n.SecurityNetty4HttpServerTransport", "cluster.name": "elastic", "node.name": "elastic-es-default-0", "message": "received plaintext http traffic on an https channel, closing connection Netty4HttpChannel{localAddress=/100.65.11.6:9200, remoteAddress=/100.65.11.8:43002}", "cluster.uuid": "blyc_Ps6QNiS-U3iMLh88g",...

> 看es日志，貌似是htpps引起的 > {"type": "server", "timestamp": "2020-06-23T03:21:06,009Z", "level": "WARN", "component": "o.e.x.s.t.n.SecurityNetty4HttpServerTransport", "cluster.name": "elastic", "node.name": "elastic-es-default-0", "message": "received plaintext http traffic on an https channel, closing connection Netty4HttpChannel{localAddress=/100.65.11.6:9200, remoteAddress=/100.65.11.8:43002}", "cluster.uuid": "blyc_Ps6QNiS-U3iMLh88g",...

> "stacktrace": ["org.elasticsearch.index.mapper.MapperParsingException: Failed to parse mapping [_doc]: Root mapping definition has unsupported parameters: > > 这在elastic和filebeat日志中都有体现。 好吧

> 我也遇到这个问题了，看起来这个项目好像不维护了。这么好的项目为啥呢？ 他们自己魔改了 filebeat 6.1.1 用官方的所有其他版本是不行滴。。。。

> 7.x filebeat默认的配置开启了ILM，导致索引的命名规则被ILM策略控制。可以通过es管理索引生命周期策略来按日分索引索引。调用es的api或者kibana可视化配置都可以实现。 问题是我使用官方 filebeat 6.x.x 也只会创建 filebeat-6.x.x-2020.04.17-000001 的索引... 所以是官方魔改了 filebeat 6.1.1-3 吗？

> > 请问一下，这个改动是否在生产环境上跑起来了？我这边想把这个改动加上去 > > 恩，已经在生产环境运行了四五个月了 阿里是不是自己魔改了 filebeat-6.1.1-3 ？我尝试使用 elasitc官方的 filebeat 发现无法自动按照业务创建索引。。

> 可以尝试新工具 https://github.com/chenjiandongx/conveyor ES支持密码认证么

> 配置filebeat7.6.1，修改如下配置文件重新打包就可以了，已测试运行 > **assets/filebeat/config.filebeat** > 主要是filebeat.yml新版本配置项变化 >  > 增加logstash集群配置 >  > **assets/filebeat/filebeat.tpl** > 删除 > {{if .Stdout}} > docker-json: true > {{end}} > 新版本没有docker-json，有单独的docker/containers type > [详细查看官网](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-log.html) 大佬升级后，es里统一写一个索引还是（像目前这样）每个APP都会按天创建自己索引？