环境：
OS:Centos 7
ES:6.8.5
问题1:
[2023-10-25T09:29:53,892][INFO ][logstash.outputs.elasticsearch] retrying failed action with response code: 429 ({"type"=>"es_rejected_execution_exception", "reason"=>"rejected execution of processing of [1303][indices:data/write/bulk[s][p]]: request: BulkShardRequest [[.monitoring-kibana-6-2023.10.22][0]] containing [195] requests, target allocation id: 3gB-75SDS0O61UaXT0cllg, primary term: 1 on EsThreadPoolExecutor[name = bIBMAMR/write, queue capacity = 200, org.elasticsearch.common.util.concurrent.EsThreadPoolExecutor@1ac7124d[Running, pool size = 2, active threads = 2, queued tasks = 200, completed tasks = 558]]"})
解决办法:
修改logstash.yml文件
pipeline.workers: 2 (原来是4)
pipeline.batch.delay: 5
pipeline.batch.size: 2000 (原来是10000)
问题2:
[ERROR][logstash.outputs.elasticsearch] Encountered a retryable error
原因是同步了.security-6这个index后,密码不一样了
[2023-10-25T10:34:12,373][INFO ][o.e.x.s.a.AuthenticationService] [2xatSTH] Authentication of [elastic] was terminated by realm [reserved] - failed to authenticate user [elastic]
解决办法：
使用index模糊匹配的方式不同步.security-6