ELK配置watcher

watcher的配置可参照:https://kibana.logstash.es/content/elasticsearch/other/watcher.html

  • SearchPhaseExecutionException[all shards failed]; nested: [Field data loading is forbidden on [filename]]; nested: IllegalStateException[Field data loading is forbidden on [filename]];

按照指南中操作后,transform中的查询会触发该错误,将字段名后追加.raw即可。该例中:filename =》 filename.raw

  • Likely root cause: expected '<document start>', but found BlockMappingStart

watcher的邮件配置请参照【https://www.elastic.co/guide/en/watcher/2.4/email-services.html】,追加到elasticsearch.yml文件后,watcher前必须加空格,否则启动elasticsearch将出错。

watcher.actions.email.service.account:
    work:
        profile: gmail
        email_defaults:
            from: 'John Doe <john.doe@host.domain>'
            bcc: archive@host.domain
        smtp:
            auth: true
            starttls.enable: true
            host: smtp.gmail.com
            port: 587
            user: <username>
            password: <password>
  •   watcher相关的api

## 查看watcher列表
GET .watches/_search
{
        "fields" : [], 
        "query" : {"match_all" : { } }
}
## 查看watcher
GET _watcher/watch/ftp_file_status
## 取消激活watcher
PUT _watcher/watch/ftp_file_status/_deactivate
## 删除watcher
DELETE _watcher/watch/ftp_status
posted @ 2017-04-05 17:43  疯子峰  阅读(3039)  评论(0编辑  收藏  举报