Logstash对接OpenSearch v2禁用ECS时加载默认模板失败求助

错误现象 #

启动Logstash时出现以下错误，核心提示为禁用ECS后无法找到OpenSearch v2对应的模板文件，导致模板安装失败：

logstash  | [2022-07-16T00:30:42,097][ERROR][logstash.outputs.opensearch][task1] 安装模板失败 {:message=>"禁用ECS时无法加载OpenSearch v2的默认模板；原因：#<ArgumentError: 未找到模板文件'/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-opensearch-1.2.0-java/lib/logstash/outputs/opensearch/templates/ecs-disabled/2x.json'>", :exception=>RuntimeError, :backtrace=>["/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-opensearch-1.2.0-java/lib/logstash/outputs/opensearch/template_manager.rb:33:in `load_default_template'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-opensearch-1.2.0-java/lib/logstash/outputs/opensearch/template_manager.rb:21:in `install_template'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-opensearch-1.2.0-java/lib/logstash/outputs/opensearch.rb:412:in `install_template'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-opensearch-1.2.0-java/lib/logstash/outputs/opensearch.rb:247:in `finish_register'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-opensearch-1.2.0-java/lib/logstash/outputs/opensearch.rb:224:in `block in register'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-opensearch-1.2.0-java/lib/logstash/plugin_mixins/opensearch/common.rb:83:in `block in after_successful_connection'"]}
logstash  | [2022-07-16T00:30:42,106][ERROR][logstash.outputs.opensearch][task2] 安装模板失败 {:message=>"禁用ECS时无法加载OpenSearch v2的默认模板；原因：#<ArgumentError: 未找到模板文件'/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-opensearch-1.2.0-java/lib/logstash/outputs/opensearch/templates/ecs-disabled/2x.json'>", :exception=>RuntimeError, :backtrace=>["/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-opensearch-1.2.0-java/lib/logstash/outputs/opensearch/template_manager.rb:33:in `load_default_template'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-opensearch-1.2.0-java/lib/logstash/outputs/opensearch/template_manager.rb:21:in `install_template'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-opensearch-1.2.0-java/lib/logstash/outputs/opensearch.rb:412:in `install_template'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-opensearch-1.2.0-java/lib/logstash/outputs/opensearch.rb:247:in `finish_register'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-opensearch-1.2.0-java/lib/logstash/outputs/opensearch.rb:224:in `block in register'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-opensearch-1.2.0-java/lib/logstash/plugin_mixins/opensearch/common.rb:83:in `block in after_successful_connection'"]}

原因分析 #

这是Logstash的logstash-output-opensearch插件1.2.0版本的资源缺失问题：当配置ecs_compatibility => disabled时，插件未提供OpenSearch v2版本对应的ECS禁用模板文件，触发模板加载失败。

解决方案 #

1. 升级输出插件到最新版本 #

后续版本的插件已修复该问题，执行以下命令升级插件：

bin/logstash-plugin update logstash-output-opensearch

升级完成后重启Logstash即可生效。

2. 手动添加缺失的模板文件 #

若无法升级插件，可手动补全模板文件：

• 创建目标目录：

  mkdir -p /usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-opensearch-1.2.0-java/lib/logstash/outputs/opensearch/templates/ecs-disabled/
  

• 获取兼容的OpenSearch v2 ECS禁用模板内容（可从高版本同插件中提取，或参考官方模板结构自行调整），保存为2x.json并放入上述目录。

3. 临时启用ECS兼容 #

若业务无需禁用ECS，可移除Logstash输出配置中的ecs_compatibility => disabled项，插件将自动使用ECS启用的模板，绕过文件缺失错误。

内容的提问来源于stack exchange，提问作者luckybird