禁用日志"logstash.outputs.elasticsearch"

Question

我想禁用日志中作为输出的连续警告消息

[2022-09-20T20:28:54,604][WARN ][logstash.outputs.elasticsearch][main] Attempted to resurrect connection to dead ES instance, but got an error {:url=>"http://elasticsearch:9200/", :exception=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::BadResponseCodeError, :message=>"Got response code '401' contacting Elasticsearch at URL 'http://elasticsearch:9200/'"}

我读了很多帖子，xpack.monitoring.enabled: false似乎为人们工作。我的日志存储配置是

http.host: "0.0.0.0"
path.config: /usr/share/logstash/pipeline
pipeline.ecs_compatibility: disabled
xpack.monitoring.enabled: false

但我仍然不断收到那些警告信息。有什么办法把他们赶走吗？

Answer 1

xpack.monitoring.enabled仅适用于将监控(但不记录！！(数据发送到Elasticsearch。

你可以像这个一样动态更新Logstash日志级别

curl -XPUT 'localhost:9600/_node/logging?pretty' -H 'Content-Type: application/json' -d'
{
"logger.logstash.outputs.elasticsearch" : "ERROR"
}
'

或直接在log4j.properties文件中

logger.elasticsearchoutput.name = logstash.outputs.elasticsearch
logger.elasticsearchoutput.level = error