解决logstash.outputs.elasticsearch[main] Could not index event to Elasticsearch status 404

提示：扫一扫查出行
【扫一扫了解最新限行尾号】
复制提示

现象：lostack启动正常，logstack收集输入redis数据，输出到elasticsearch写入失败

提示：去建索引的时候elasticsearch返回404

[2019-11-12T11:37:29,009][WARN ][logstash.outputs.elasticsearch][main] Could not index event to Elasticsearch. {:status=>404, :action=>["index", {:_id=>nil, :_index=>"nginx-172.16.2.13-2019.11.12", :_type=>"doc", :_routing=>nil}, #<LogStash::Event:0x26f38258>], :response=>{"index"=>{"_index"=>"nginx-172.16.2.13-2019.11.12", "_type"=>"doc", "_id"=>nil, "status"=>404, "error"=>{"type"=>"index_not_found_exception", "reason"=>"no such index", "resource.type"=>"index_expression", "resource.id"=>"nginx-172.16.2.13-2019.11.12", "index_uuid"=>"_na_", "index"=>"nginx-172.16.2.13-2019.11.12"}}}}

解决方法：

因elasticsearch配置问题导致，action.auto_create_index: false #禁用自动创建index

将false改成true即可，或者删除这个配置，查阅官方文档改配置是默认开启的。

希望能帮你解决。