I am upgrading my logstash from 7.x.x to 8.2.0. Problem is, logstash is not able to run the pipeline, showing the following error.

    [2022-07-16T21:36:58,445][ERROR][org.logstash.common.io.DeadLetterQueueWriter][main][5cbc025fde4301c797acb18d0739a992e350be4c8a5674b4f85a17894ba2f28e] cannot write event to DLQ(path: /usr/share/logstash/failed/queue/main): reached maxQueueSize of 1073741824

Logstash filters the data from cloud foundry and send the events to elastic and create an index.

This thing was working fine in 7.x.x version but after the upgrade its failing.

I tried to add the following line in logstash.yml to make pipeline 7.x.x to compatible with 8.x.x but the same result

    ecs_compatibility => disabled

It seems elastic 8.x.x version is not able to process the _doc.

logstash type"=>"illegal_argument_exception

Do anyone know the workaround, It is really frustrating.

Thanks!

CodePudding user response：

you could delete the /usr/share/logstash/failed/queue/main/* and problem will be solve for a moment but The root cause of the failure will not be found. so open /usr/share/logstash/failed/queue/main/1.log and findout what cause the logstash or elasticsearch failed to index the data.

maybe you didn't upgrade both elasticsearch and logstash or there is some plugin have been change between 7.x to 8.x.

CodePudding user response：

I found the problem, template in kibana was created in data view. I just deleted it and created the template in legacy mode and

set the following line output.conf

data_stream => false

It worked.