elasticsearch 将url标记为已死亡。最后一个错误：主机无法访问错误

我已经将我的ElasticSearch集群从6.6更新到7.6.2，作为此次升级的一部分，删除了所有字段和默认字段

我更新了集群，检查了日志，果然，我的一个模板抱怨这些字段存在。我的所有其他模板仍然正确地收集数据并将数据推送到ElasticSearch/Kibana

因此，使用API控制台，我运行了一个PUT to/_template/logstash-qa01-stats来更新模板：

{
  "template" : "logstash-qa01-stats-*",
  "settings" : {
    "index.refresh_interval" : "10s"
  },
  "mappings" : {
    "_default_" : {
       "_all" : { "enabled" : false, "norms" : false },
      "dynamic_templates" : [ {
          "string_fields": {
            "match": "*",
            "match_mapping_type": "string",
            "mapping": { "type": "text", "index": true }
          }
        }, {
          "byte_fields" : {
            "match" : "*",
            "match_mapping_type" : "long",
            "mapping" : { "type" : "double", "doc_values": true }
          }
        }, {
          "short_fields" : {
            "match" : "*",
            "match_mapping_type" : "long",
            "mapping" : { "type" : "double", "doc_values": true }
          }
        }, {
          "integer_fields" : {
            "match" : "*",
            "match_mapping_type" : "long",
            "mapping" : { "type" : "double", "doc_values": true }
          }
        }, {
          "long_fields" : {
            "match" : "*",
            "match_mapping_type" : "long",
            "mapping" : { "type" : "double", "doc_values": true }
          }
        }, {
          "float_fields": {
            "match": "*",
            "match_mapping_type": "double",
            "mapping": { "type": "double", "doc_values": true }
          }
        }],
        "properties" : {
          "@timestamp": { "type" : "date", "format": "date_optional_time" },
          "@version" : { "type" : "keyword", "index": true },
          "type_instance" : { "type" : "text", "index" : true, "norms" : false,
            "fields" : {
              "raw" : { "type": "text", "index" : true }
            }
          }
        }
    }
  }
}

致：

控制台接受了这一点，并回复200 OK

我回到我的日志，以确保数据正在处理，现在我得到的是：

[2020-04-15T20:28:52,111][ERROR][logstash.outputs.elasticsearch] Attempted to send a bulk request to elasticsearch' but Elasticsearch appears to be unreachable or down! {:error_message=>"Elasticsearch Unreachable: [https://logstash-qa01:xxxxxx@ea33a63cd7ed235230b7aedcd62e4c37.eu-west-1.aws.found.io:9243/][Manticore::SocketTimeout] Read timed out", :class=>"LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError", :will_retry_in_seconds=>64}
[2020-04-15T20:28:52,663][WARN ][logstash.outputs.elasticsearch] Marking url as dead. Last error: [LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError] Elasticsearch Unreachable: [https://logstash-qa01:xxxxxx@ea33a63cd7ed235230b7aedcd62e4c37.eu-west-1.aws.found.io:9243/][Manticore::SocketTimeout] Read timed out {:url=>https://logstash-qa01:xxxxxx@ea33a63cd7ed235230b7aedcd62e4c37.eu-west-1.aws.found.io:9243/, :error_message=>"Elasticsearch Unreachable: [https://logstash-qa01:xxxxxx@ea33a63cd7ed235230b7aedcd62e4c37.eu-west-1.aws.found.io:9243/][Manticore::SocketTimeout] Read timed out", :error_class=>"LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError"}
[2020-04-15T20:28:52,664][ERROR][logstash.outputs.elasticsearch] Attempted to send a bulk request to elasticsearch' but Elasticsearch appears to be unreachable or down! {:error_message=>"Elasticsearch Unreachable: [https://logstash-qa01:xxxxxx@ea33a63cd7ed235230b7aedcd62e4c37.eu-west-1.aws.found.io:9243/][Manticore::SocketTimeout] Read timed out", :class=>"LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError", :will_retry_in_seconds=>64}
[2020-04-15T20:28:56,245][INFO ][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck_url=>https://logstash-qa01:xxxxxx@ea33a63cd7ed235230b7aedcd62e4c37.eu-west-1.aws.found.io:9243/, :path=>"/"}
[2020-04-15T20:28:56,346][WARN ][logstash.outputs.elasticsearch] Restored connection to ES instance {:url=>"https://logstash-qa01:xxxxxx@ea33a63cd7ed235230b7aedcd62e4c37.eu-west-1.aws.found.io:9243/"}

一遍又一遍。没有数据被记录到ElasticSearch/Kibana，除非我重新启动logstash，然后推送丢失的数据，但随后它停止发送新数据

这个集群已经好几年了，我不明白模板的改变怎么会把它破坏得这么严重

我可以访问我的弹性域并获得以下信息：

{
  "name" : "instance-0000000105",
  "cluster_name" : "ea33a63cd7ed235230b7aedcd62e4c37",
  "cluster_uuid" : "Tl84gLdZRI26oPe9FRWVuw",
  "version" : {
    "number" : "7.6.2",
    "build_flavor" : "default",
    "build_type" : "tar",
    "build_hash" : "ef48eb35cf30adf4db14086e8aabd07ef6fb113f",
    "build_date" : "2020-03-26T06:34:37.794943Z",
    "build_snapshot" : false,
    "lucene_version" : "8.4.0",
    "minimum_wire_compatibility_version" : "6.8.0",
    "minimum_index_compatibility_version" : "6.0.0-beta1"
  },
  "tagline" : "You Know, for Search"
}

我的其他使用相同ElasticSearch群集的环境只有在我更新报告其环境中问题的相同模板时才会受到影响

有人对这里可能发生的事情有什么建议吗

{
  "name" : "instance-0000000105",
  "cluster_name" : "ea33a63cd7ed235230b7aedcd62e4c37",
  "cluster_uuid" : "Tl84gLdZRI26oPe9FRWVuw",
  "version" : {
    "number" : "7.6.2",
    "build_flavor" : "default",
    "build_type" : "tar",
    "build_hash" : "ef48eb35cf30adf4db14086e8aabd07ef6fb113f",
    "build_date" : "2020-03-26T06:34:37.794943Z",
    "build_snapshot" : false,
    "lucene_version" : "8.4.0",
    "minimum_wire_compatibility_version" : "6.8.0",
    "minimum_index_compatibility_version" : "6.0.0-beta1"
  },
  "tagline" : "You Know, for Search"
}