首先

在我想尽快搭建测试用的Elasticsearch和Kibana环境时，我发现有一个容器版本，于是我尝试了一下。
以下是在确认能在Linux上启动之前的操作日志。
（虽然我希望能够很快进行，但由于使用了Podman，实际上遇到了一些麻烦。）

环境资讯

我将使用以下环境（基于云平台的IaaS）。

REHL V8.5
简述：红帽企业Linux（REHL）版本8.5

Podman V3.4.2
简述：Podman版本3.4.2

Elasticsearch/Kibana V8.0
简述：Elasticsearch/Kibana版本8.0

由于测试环境的需要，Elasticsearch仅采用单节点配置。

参考资料

根据以下文章继续进行。
在 Docker 上运行 Elastic Stack (“ELK”)
尽管这篇文档提供了使用 Docker 的步骤，但由于我们要构建的环境是 RHEL，所以我们将在此处使用与 RHEL 兼容的 Podman。

Podman命令的命令参考资料在这里。

顺便提一下，作为容器版本的ELK，也提供了以下形式。这个版本包含了Elasticsearch、Logstash和Kibana的一个镜像，非常易于操作。但是，截至2022年2月，仅提供了V7.x版本。

elk-docker
虽然我不需要最新版本，但我想尝试一下新版本，所以这次我选择了之前提到的那个（在那个版本中，Elasticsearch和Kibana是分别提供的不同镜像）。

环境设备

安装Podman

在Yum上安装Podman软件包。

[TOMOTAG@ISEI20220214-2245-natural-2 ~]$ sudo yum install podman
...

版本检查

[TOMOTAG@ISEI20220214-2245-natural-2 ~]$ sudo podman version
Version:      3.4.2
API Version:  3.4.2
Go Version:   go1.16.7
Built:        Thu Jan 13 19:15:49 2022
OS/Arch:      linux/amd64

如果使用root进行处理，镜像和容器信息将被放置在/var/lib/containers目录下。

我将尝试在测试中运行busybox。
拉取busybox的映像。

[TOMOTAG@ISEI20220214-2245-natural-2 ~]$ sudo podman pull busybox
Resolved "busybox" as an alias (/etc/containers/registries.conf.d/000-shortnames.conf)
Trying to pull docker.io/library/busybox:latest...
Getting image source signatures
Copying blob 009932687766 done
Copying config ec3f0931a6 done
Writing manifest to image destination
Storing signatures
ec3f0931a6e6b6855d76b2d7b0be30e81860baccd891b2e243280bf1cd8ad710

[TOMOTAG@ISEI20220214-2245-natural-2 ~]$ sudo podman image ls -a
REPOSITORY                 TAG         IMAGE ID      CREATED      SIZE
docker.io/library/busybox  latest      ec3f0931a6e6  2 weeks ago  1.46 MB

启动busybox容器

[TOMOTAG@ISEI20220214-2245-natural-2 ~]$ sudo podman run -it --rm busybox sh
/ # exit

听起来还不错。

创建管理员用户

创建一个名为`elkusr01`的用户，并且以后基本上使用该用户来管理Elasticsearch/Kibana。

[TOMOTAG@ISEI20220214-2245-natural-2 ~]$ sudo useradd elkusr01
[TOMOTAG@ISEI20220214-2245-natural-2 ~]$ sudo passwd elkusr01
ユーザー elkusr01 のパスワードを変更。
新しいパスワード:
新しいパスワードを再入力してください:
passwd: すべての認証トークンが正しく更新できました。

如果使用该用户进行Podman操作，则镜像等文件将被管理在家目录下的~/.local/share/containers/文件夹中。

Elasticsearch/Kibana配置

按照之前文件的步骤进行实施。

拉取 Elasticsearch 镜像

[elkusr01@ISEI20220214-2245-natural-2 ~]$ podman pull docker.elastic.co/elasticsearch/elasticsearch:8.0.0
Trying to pull docker.elastic.co/elasticsearch/elasticsearch:8.0.0...
Getting image source signatures
Copying blob 5a1f83eba229 done
Copying blob 4fb807caa40a done
Copying blob 239bfee9d5a6 done
Copying blob 23719abad09c done
Copying blob a0b868ce44e0 done
Copying blob fe259c2cfb37 done
Copying blob d79c49847382 done
Copying blob 1b3b32eb35fb done
Copying blob 54022fd7ed62 done
Copying blob 1a692ef55082 done
Copying config fef75c4283 done
Writing manifest to image destination
Storing signatures
fef75c42834fe3e0ddec4be2a6f929bbe5b1d7a8d41230c05e1485545f8d9433

拉取Kibana镜像的图像

[elkusr01@ISEI20220214-2245-natural-2 ~]$ podman pull docker.elastic.co/kibana/kibana:8.0.0
Trying to pull docker.elastic.co/kibana/kibana:8.0.0...
Getting image source signatures
Copying blob 4fb807caa40a skipped: already exists
Copying blob ee292ea0b2d8 done
Copying blob 18fb5f40ceeb done
Copying blob 79b3fffe2055 done
Copying blob 37f4ca134c19 done
Copying blob 2f2233f5ff7b done
Copying blob 8224d44a5740 done
Copying blob a241ecc5341c done
Copying blob bba8d08541d3 done
Copying blob 50fc71ef13f7 done
Copying blob 5839a33ca898 done
Copying blob 3e99639131bd done
Copying blob 1a033a4304dc done
Copying config b752a78319 done
Writing manifest to image destination
Storing signatures
b752a783190b8b4cfb543a1af83c86944b62662558c9e2f16611989e1314a73c

“vm.max_map_count” 的设置

这是试错的初级阶段，但在启动Elasticsearch时发生了以下错误导致失败。

エラー時のElasticsearch起動ログ
※この時はsudoでroot権限で実行してました
[TOMOTAG@ISEI20220214-2245-natural-2 ~]$ sudo podman run –name es01 –net elastic -p 9200:9200 -it docker.elastic.co/elasticsearch/elasticsearch:8.0.0
{“@timestamp”:”2022-02-25T12:19:42.905Z”, “log.level”: “INFO”, “message”:”version[8.0.0], pid[7], build[default/docker/1b6a7ece17463df5ff54a3e1302d825889aa1161/2022-02-03T16:47:57.507843096Z], OS[Linux/4.18.0-348.12.2.el8_5.x86_64/amd64], JVM[Eclipse Adoptium/OpenJDK 64-Bit Server VM/17.0.1/17.0.1+12]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.node.Node”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:19:42.929Z”, “log.level”: “INFO”, “message”:”JVM home [/usr/share/elasticsearch/jdk], using bundled JDK [true]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.node.Node”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:19:42.929Z”, “log.level”: “INFO”, “message”:”JVM arguments [-Xshare:auto, -Des.networkaddress.cache.ttl=60, -Des.networkaddress.cache.negative.ttl=10, -Djava.security.manager=allow, -XX:+AlwaysPreTouch, -Xss1m, -Djava.awt.headless=true, -Dfile.encoding=UTF-8, -Djna.nosys=true, -XX:-OmitStackTraceInFastThrow, -XX:+ShowCodeDetailsInExceptionMessages, -Dio.netty.noUnsafe=true, -Dio.netty.noKeySetOptimization=true, -Dio.netty.recycler.maxCapacityPerThread=0, -Dio.netty.allocator.numDirectArenas=0, -Dlog4j.shutdownHookEnabled=false, -Dlog4j2.disable.jmx=true, -Dlog4j2.formatMsgNoLookups=true, -Djava.locale.providers=SPI,COMPAT, –add-opens=java.base/java.io=ALL-UNNAMED, -XX:+UseG1GC, -Djava.io.tmpdir=/tmp/elasticsearch-12732126488124304066, -XX:+HeapDumpOnOutOfMemoryError, -XX:+ExitOnOutOfMemoryError, -XX:HeapDumpPath=data, -XX:ErrorFile=logs/hs_err_pid%p.log, -Xlog:gc*,gc+age=trace,safepoint:file=logs/gc.log:utctime,pid,tags:filecount=32,filesize=64m, -Des.cgroups.hierarchy.override=/, -Xms3971m, -Xmx3971m, -XX:MaxDirectMemorySize=2082471936, -XX:G1HeapRegionSize=4m, -XX:InitiatingHeapOccupancyPercent=30, -XX:G1ReservePercent=15, -Des.path.home=/usr/share/elasticsearch, -Des.path.conf=/usr/share/elasticsearch/config, -Des.distribution.flavor=default, -Des.distribution.type=docker, -Des.bundled_jdk=true]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.node.Node”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:19:46.711Z”, “log.level”: “WARN”, “message”:”SLF4J: Failed to load class \”org.slf4j.impl.StaticLoggerBinder\”.”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”stderr”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:19:46.713Z”, “log.level”: “WARN”, “message”:”SLF4J: Defaulting to no-operation (NOP) logger implementation”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”stderr”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:19:46.714Z”, “log.level”: “WARN”, “message”:”SLF4J: See http://www.slf4j.org/codes.html#StaticLoggerBinder for further details.”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”stderr”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:19:48.843Z”, “log.level”: “INFO”, “message”:”loaded module [aggs-matrix-stats]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:19:48.843Z”, “log.level”: “INFO”, “message”:”loaded module [analysis-common]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:19:48.844Z”, “log.level”: “INFO”, “message”:”loaded module [constant-keyword]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:19:48.844Z”, “log.level”: “INFO”, “message”:”loaded module [frozen-indices]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:19:48.844Z”, “log.level”: “INFO”, “message”:”loaded module [ingest-common]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:19:48.845Z”, “log.level”: “INFO”, “message”:”loaded module [ingest-geoip]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:19:48.845Z”, “log.level”: “INFO”, “message”:”loaded module [ingest-user-agent]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:19:48.845Z”, “log.level”: “INFO”, “message”:”loaded module [kibana]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:19:48.845Z”, “log.level”: “INFO”, “message”:”loaded module [lang-expression]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:19:48.846Z”, “log.level”: “INFO”, “message”:”loaded module [lang-mustache]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:19:48.846Z”, “log.level”: “INFO”, “message”:”loaded module [lang-painless]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:19:48.846Z”, “log.level”: “INFO”, “message”:”loaded module [legacy-geo]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:19:48.846Z”, “log.level”: “INFO”, “message”:”loaded module [mapper-extras]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:19:48.847Z”, “log.level”: “INFO”, “message”:”loaded module [mapper-version]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:19:48.847Z”, “log.level”: “INFO”, “message”:”loaded module [parent-join]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:19:48.847Z”, “log.level”: “INFO”, “message”:”loaded module [percolator]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:19:48.848Z”, “log.level”: “INFO”, “message”:”loaded module [rank-eval]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:19:48.848Z”, “log.level”: “INFO”, “message”:”loaded module [reindex]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:19:48.848Z”, “log.level”: “INFO”, “message”:”loaded module [repositories-metering-api]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:19:48.848Z”, “log.level”: “INFO”, “message”:”loaded module [repository-azure]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:19:48.849Z”, “log.level”: “INFO”, “message”:”loaded module [repository-encrypted]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:19:48.849Z”, “log.level”: “INFO”, “message”:”loaded module [repository-gcs]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:19:48.849Z”, “log.level”: “INFO”, “message”:”loaded module [repository-s3]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:19:48.850Z”, “log.level”: “INFO”, “message”:”loaded module [repository-url]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:19:48.850Z”, “log.level”: “INFO”, “message”:”loaded module [runtime-fields-common]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:19:48.850Z”, “log.level”: “INFO”, “message”:”loaded module [search-business-rules]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:19:48.850Z”, “log.level”: “INFO”, “message”:”loaded module [searchable-snapshots]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:19:48.851Z”, “log.level”: “INFO”, “message”:”loaded module [snapshot-based-recoveries]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:19:48.851Z”, “log.level”: “INFO”, “message”:”loaded module [snapshot-repo-test-kit]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:19:48.851Z”, “log.level”: “INFO”, “message”:”loaded module [spatial]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:19:48.852Z”, “log.level”: “INFO”, “message”:”loaded module [transform]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:19:48.853Z”, “log.level”: “INFO”, “message”:”loaded module [transport-netty4]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:19:48.853Z”, “log.level”: “INFO”, “message”:”loaded module [unsigned-long]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:19:48.853Z”, “log.level”: “INFO”, “message”:”loaded module [vector-tile]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:19:48.853Z”, “log.level”: “INFO”, “message”:”loaded module [vectors]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:19:48.854Z”, “log.level”: “INFO”, “message”:”loaded module [wildcard]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:19:48.854Z”, “log.level”: “INFO”, “message”:”loaded module [x-pack-aggregate-metric]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:19:48.854Z”, “log.level”: “INFO”, “message”:”loaded module [x-pack-analytics]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:19:48.854Z”, “log.level”: “INFO”, “message”:”loaded module [x-pack-async]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:19:48.855Z”, “log.level”: “INFO”, “message”:”loaded module [x-pack-async-search]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:19:48.855Z”, “log.level”: “INFO”, “message”:”loaded module [x-pack-autoscaling]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:19:48.855Z”, “log.level”: “INFO”, “message”:”loaded module [x-pack-ccr]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:19:48.855Z”, “log.level”: “INFO”, “message”:”loaded module [x-pack-core]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:19:48.856Z”, “log.level”: “INFO”, “message”:”loaded module [x-pack-data-streams]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:19:48.856Z”, “log.level”: “INFO”, “message”:”loaded module [x-pack-deprecation]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:19:48.856Z”, “log.level”: “INFO”, “message”:”loaded module [x-pack-enrich]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:19:48.856Z”, “log.level”: “INFO”, “message”:”loaded module [x-pack-eql]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:19:48.857Z”, “log.level”: “INFO”, “message”:”loaded module [x-pack-fleet]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:19:48.857Z”, “log.level”: “INFO”, “message”:”loaded module [x-pack-graph]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:19:48.857Z”, “log.level”: “INFO”, “message”:”loaded module [x-pack-identity-provider]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:19:48.857Z”, “log.level”: “INFO”, “message”:”loaded module [x-pack-ilm]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:19:48.858Z”, “log.level”: “INFO”, “message”:”loaded module [x-pack-logstash]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:19:48.858Z”, “log.level”: “INFO”, “message”:”loaded module [x-pack-ml]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:19:48.858Z”, “log.level”: “INFO”, “message”:”loaded module [x-pack-monitoring]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:19:48.858Z”, “log.level”: “INFO”, “message”:”loaded module [x-pack-ql]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:19:48.859Z”, “log.level”: “INFO”, “message”:”loaded module [x-pack-rollup]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:19:48.859Z”, “log.level”: “INFO”, “message”:”loaded module [x-pack-security]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:19:48.859Z”, “log.level”: “INFO”, “message”:”loaded module [x-pack-shutdown]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:19:48.859Z”, “log.level”: “INFO”, “message”:”loaded module [x-pack-sql]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:19:48.860Z”, “log.level”: “INFO”, “message”:”loaded module [x-pack-stack]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:19:48.860Z”, “log.level”: “INFO”, “message”:”loaded module [x-pack-text-structure]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:19:48.860Z”, “log.level”: “INFO”, “message”:”loaded module [x-pack-voting-only-node]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:19:48.861Z”, “log.level”: “INFO”, “message”:”loaded module [x-pack-watcher]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:19:48.861Z”, “log.level”: “INFO”, “message”:”no plugins loaded”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:19:48.932Z”, “log.level”: “INFO”, “message”:”using [1] data paths, mounts [[/ (overlay)]], net usable_space [457.8gb], net total_space [491.1gb], types [overlay]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.env.NodeEnvironment”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:19:48.933Z”, “log.level”: “INFO”, “message”:”heap size [3.8gb], compressed ordinary object pointers [true]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.env.NodeEnvironment”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:19:48.963Z”, “log.level”: “INFO”, “message”:”node name [46a240dfb819], node ID [ZqlMpYVpRtS2vJm1Anx9VQ], cluster name [docker-cluster], roles [ingest, data_frozen, ml, data_hot, transform, data_content, data_warm, master, remote_cluster_client, data, data_cold]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.node.Node”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:19:57.659Z”, “log.level”: “INFO”, “message”:”[controller/308] [Main.cc@123] controller (64 bit): Version 8.0.0 (Build 5e85495ea85316) Copyright (c) 2022 Elasticsearch BV”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”ml-cpp-log-tail-thread”,”log.logger”:”org.elasticsearch.xpack.ml.process.logging.CppLogMessageHandler”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:19:57.955Z”, “log.level”: “INFO”, “message”:”Security is enabled”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.xpack.security.Security”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:19:58.428Z”, “log.level”: “INFO”, “message”:”license mode is [trial], currently licensed security realms are [reserved/reserved,file/default_file,native/default_native]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.xpack.security.authc.Realms”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:19:58.445Z”, “log.level”: “INFO”, “message”:”parsed [0] roles from file [/usr/share/elasticsearch/config/roles.yml]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.xpack.security.authz.store.FileRolesStore”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}{“@timestamp”:”2022-02-25T12:20:00.932Z”, “log.level”: “INFO”, “message”:”creating NettyAllocator with the following configs: [name=elasticsearch_configured, chunk_size=1mb, suggested_max_allocation_size=1mb, factors={es.unsafe.use_netty_default_chunk_and_page_size=false, g1gc_enabled=true, g1gc_region_size=4mb}]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.transport.netty4.NettyAllocator”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:20:01.039Z”, “log.level”: “INFO”, “message”:”using discovery type [zen] and seed hosts providers [settings]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.discovery.DiscoveryModule”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:20:02.924Z”, “log.level”: “INFO”, “message”:”initialized”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.node.Node”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:20:02.925Z”, “log.level”: “INFO”, “message”:”starting …”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.node.Node”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:20:02.984Z”, “log.level”: “INFO”, “message”:”persistent cache index loaded”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.xpack.searchablesnapshots.cache.full.PersistentCache”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:20:02.986Z”, “log.level”: “INFO”, “message”:”deprecation component started”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.xpack.deprecation.logging.DeprecationIndexingComponent”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:20:03.239Z”, “log.level”: “INFO”, “message”:”publish_address {10.89.0.2:9300}, bound_addresses {[::]:9300}”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.transport.TransportService”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:20:03.439Z”, “log.level”: “INFO”, “message”:”bound or publishing to a non-loopback address, enforcing bootstrap checks”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.bootstrap.BootstrapChecks”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}

ERROR: [1] bootstrap checks failed. You must address the points described in the following [1] lines before starting Elasticsearch.
bootstrap check failure [1] of [1]: max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]
ERROR: Elasticsearch did not exit normally – check the logs at /usr/share/elasticsearch/logs/docker-cluster.log
{“@timestamp”:”2022-02-25T12:20:03.501Z”, “log.level”: “INFO”, “message”:”stopping …”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”Thread-2″,”log.logger”:”org.elasticsearch.node.Node”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:20:03.702Z”, “log.level”: “INFO”, “message”:”stopped”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”Thread-2″,”log.logger”:”org.elasticsearch.node.Node”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:20:03.703Z”, “log.level”: “INFO”, “message”:”closing …”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”Thread-2″,”log.logger”:”org.elasticsearch.node.Node”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:20:03.752Z”, “log.level”: “INFO”, “message”:”closed”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”Thread-2″,”log.logger”:”org.elasticsearch.node.Node”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-25T12:20:03.756Z”, “log.level”: “INFO”, “message”:”Native controller process has stopped – no new native processes can be started”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”ml-cpp-log-tail-thread”,”log.logger”:”org.elasticsearch.xpack.ml.process.NativeController”,”elasticsearch.node.name”:”46a240dfb819″,”elasticsearch.cluster.name”:”docker-cluster”}

输出了以下错误。

ERROR: [1] bootstrap checks failed. You must address the points described in the following [1] lines before starting Elasticsearch.
bootstrap check failure [1] of [1]: max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]
ERROR: Elasticsearch did not exit normally - check the logs at /usr/share/elasticsearch/logs/docker-cluster.log

操作系统的内存相关参数vm.max_map_count的设置值过低，引发了报错。

参考：RHEL V8 – 系统状态和性能监控和管理章节 – 第35章 调整操作系统以优化内存访问配置。

vm.max_map_count 定义了一个进程可以使用的内存映射区域的最大数量。默认值为65530。如果您的应用程序需要更多的内存映射区域，请增加这个值。

默认值仍为65530，这似乎是不够的。考虑到需要至少262144，我们将进行更改。

※在此以root权限执行。
编辑/etc/sysctl.conf文件，添加以下内容作为最后一行。

net.ipv4.tcp_syncookies=1
net.ipv4.icmp_echo_ignore_broadcasts=1
net.ipv4.conf.all.accept_redirects=0
net.ipv4.conf.all.send_redirects = 0
vm.max_map_count=262144

将更改应用。

[TOMOTAG@ISEI20220214-2245-natural-2 ~]$ sudo sysctl -p
net.ipv4.tcp_syncookies = 1
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0
vm.max_map_count = 262144

确认

[TOMOTAG@ISEI20220214-2245-natural-2 ~]$ sudo cat /proc/sys/vm/max_map_count
262144

创建容器网络

在这里，我们将明确指定子网并创建网络（以便在创建容器时明确指定IP地址的后续步骤）。

[elkusr01@ISEI20220214-2245-natural-2 ~]$ podman network create --subnet 10.100.0.0/24 elastic
/mnt/elkusr01/.config/cni/net.d/elastic.conflist

[elkusr01@ISEI20220214-2245-natural-2 ~]$ podman network ls
NETWORK ID    NAME        VERSION     PLUGINS
2f259bab93aa  podman      0.4.0       bridge,portmap,firewall,tuning
986051385fea  elastic     0.4.0       bridge,portmap,firewall,tuning

参考：使用Podman配置容器网络

使用Podman运行时，我在网络部分遇到了问题，但以下文章非常有帮助。
参考：使用Podman协调多个容器的方法-创建Podman网络和分配固定IP给容器

创建/启动 Elasticsearch 容器

注意: 尽管参考文档中没有提到，但在这里我们明确指定了在创建Elasticsearch容器时使用的IP地址。这可能是因为我们使用了Podman，但是每次创建后反复启动/停止容器，分配的IP地址都会不同，导致无法成功连接到Kibana。因此，在创建网络时我们指定了子网，并在创建容器时明确指定IP地址。（这是因为在配置Kibana时，Elasticsearch的IP地址被静态设置了）

命令：podman run –name es01 –net elastic –ip 10.100.0.10 -p 9200:9200 -it docker.elastic.co/elasticsearch/elasticsearch:8.0.0

Chinese paraphrase: 使用podman运行以下命令：–name es01 –net elastic –ip 10.100.0.10 -p 9200:9200 -it docker.elastic.co/elasticsearch/elasticsearch:8.0.0

参考: Elasticsearch起動ログ
[elkusr01@ISEI20220214-2245-natural-2 ~]$ podman run –name es01 –net elastic –ip 10.100.0.10 -p 9200:9200 -it docker.elastic.co/elasticsearch/elasticsearch:8.0.0
{“@timestamp”:”2022-02-27T03:36:03.109Z”, “log.level”: “INFO”, “message”:”version[8.0.0], pid[7], build[default/docker/1b6a7ece17463df5ff54a3e1302d825889aa1161/2022-02-03T16:47:57.507843096Z], OS[Linux/4.18.0-348.12.2.el8_5.x86_64/amd64], JVM[Eclipse Adoptium/OpenJDK 64-Bit Server VM/17.0.1/17.0.1+12]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.node.Node”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:03.117Z”, “log.level”: “INFO”, “message”:”JVM home [/usr/share/elasticsearch/jdk], using bundled JDK [true]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.node.Node”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:03.117Z”, “log.level”: “INFO”, “message”:”JVM arguments [-Xshare:auto, -Des.networkaddress.cache.ttl=60, -Des.networkaddress.cache.negative.ttl=10, -Djava.security.manager=allow, -XX:+AlwaysPreTouch, -Xss1m, -Djava.awt.headless=true, -Dfile.encoding=UTF-8, -Djna.nosys=true, -XX:-OmitStackTraceInFastThrow, -XX:+ShowCodeDetailsInExceptionMessages, -Dio.netty.noUnsafe=true, -Dio.netty.noKeySetOptimization=true, -Dio.netty.recycler.maxCapacityPerThread=0, -Dio.netty.allocator.numDirectArenas=0, -Dlog4j.shutdownHookEnabled=false, -Dlog4j2.disable.jmx=true, -Dlog4j2.formatMsgNoLookups=true, -Djava.locale.providers=SPI,COMPAT, –add-opens=java.base/java.io=ALL-UNNAMED, -XX:+UseG1GC, -Djava.io.tmpdir=/tmp/elasticsearch-13228629507283790034, -XX:+HeapDumpOnOutOfMemoryError, -XX:+ExitOnOutOfMemoryError, -XX:HeapDumpPath=data, -XX:ErrorFile=logs/hs_err_pid%p.log, -Xlog:gc*,gc+age=trace,safepoint:file=logs/gc.log:utctime,pid,tags:filecount=32,filesize=64m, -Des.cgroups.hierarchy.override=/, -Xms3971m, -Xmx3971m, -XX:MaxDirectMemorySize=2082471936, -XX:G1HeapRegionSize=4m, -XX:InitiatingHeapOccupancyPercent=30, -XX:G1ReservePercent=15, -Des.path.home=/usr/share/elasticsearch, -Des.path.conf=/usr/share/elasticsearch/config, -Des.distribution.flavor=default, -Des.distribution.type=docker, -Des.bundled_jdk=true]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.node.Node”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:06.168Z”, “log.level”: “WARN”, “message”:”SLF4J: Failed to load class \”org.slf4j.impl.StaticLoggerBinder\”.”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”stderr”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:06.170Z”, “log.level”: “WARN”, “message”:”SLF4J: Defaulting to no-operation (NOP) logger implementation”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”stderr”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:06.171Z”, “log.level”: “WARN”, “message”:”SLF4J: See http://www.slf4j.org/codes.html#StaticLoggerBinder for further details.”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”stderr”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:07.821Z”, “log.level”: “INFO”, “message”:”loaded module [aggs-matrix-stats]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:07.822Z”, “log.level”: “INFO”, “message”:”loaded module [analysis-common]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:07.822Z”, “log.level”: “INFO”, “message”:”loaded module [constant-keyword]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:07.822Z”, “log.level”: “INFO”, “message”:”loaded module [frozen-indices]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:07.823Z”, “log.level”: “INFO”, “message”:”loaded module [ingest-common]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:07.823Z”, “log.level”: “INFO”, “message”:”loaded module [ingest-geoip]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:07.823Z”, “log.level”: “INFO”, “message”:”loaded module [ingest-user-agent]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:07.824Z”, “log.level”: “INFO”, “message”:”loaded module [kibana]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:07.824Z”, “log.level”: “INFO”, “message”:”loaded module [lang-expression]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:07.824Z”, “log.level”: “INFO”, “message”:”loaded module [lang-mustache]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:07.824Z”, “log.level”: “INFO”, “message”:”loaded module [lang-painless]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:07.825Z”, “log.level”: “INFO”, “message”:”loaded module [legacy-geo]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:07.825Z”, “log.level”: “INFO”, “message”:”loaded module [mapper-extras]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:07.825Z”, “log.level”: “INFO”, “message”:”loaded module [mapper-version]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:07.825Z”, “log.level”: “INFO”, “message”:”loaded module [parent-join]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:07.826Z”, “log.level”: “INFO”, “message”:”loaded module [percolator]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:07.826Z”, “log.level”: “INFO”, “message”:”loaded module [rank-eval]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:07.826Z”, “log.level”: “INFO”, “message”:”loaded module [reindex]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:07.827Z”, “log.level”: “INFO”, “message”:”loaded module [repositories-metering-api]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:07.827Z”, “log.level”: “INFO”, “message”:”loaded module [repository-azure]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:07.827Z”, “log.level”: “INFO”, “message”:”loaded module [repository-encrypted]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:07.827Z”, “log.level”: “INFO”, “message”:”loaded module [repository-gcs]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:07.828Z”, “log.level”: “INFO”, “message”:”loaded module [repository-s3]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:07.828Z”, “log.level”: “INFO”, “message”:”loaded module [repository-url]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:07.828Z”, “log.level”: “INFO”, “message”:”loaded module [runtime-fields-common]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:07.829Z”, “log.level”: “INFO”, “message”:”loaded module [search-business-rules]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:07.829Z”, “log.level”: “INFO”, “message”:”loaded module [searchable-snapshots]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:07.829Z”, “log.level”: “INFO”, “message”:”loaded module [snapshot-based-recoveries]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:07.829Z”, “log.level”: “INFO”, “message”:”loaded module [snapshot-repo-test-kit]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:07.829Z”, “log.level”: “INFO”, “message”:”loaded module [spatial]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:07.829Z”, “log.level”: “INFO”, “message”:”loaded module [transform]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:07.830Z”, “log.level”: “INFO”, “message”:”loaded module [transport-netty4]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:07.830Z”, “log.level”: “INFO”, “message”:”loaded module [unsigned-long]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:07.830Z”, “log.level”: “INFO”, “message”:”loaded module [vector-tile]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:07.830Z”, “log.level”: “INFO”, “message”:”loaded module [vectors]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:07.831Z”, “log.level”: “INFO”, “message”:”loaded module [wildcard]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:07.831Z”, “log.level”: “INFO”, “message”:”loaded module [x-pack-aggregate-metric]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:07.831Z”, “log.level”: “INFO”, “message”:”loaded module [x-pack-analytics]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:07.831Z”, “log.level”: “INFO”, “message”:”loaded module [x-pack-async]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:07.832Z”, “log.level”: “INFO”, “message”:”loaded module [x-pack-async-search]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:07.832Z”, “log.level”: “INFO”, “message”:”loaded module [x-pack-autoscaling]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:07.832Z”, “log.level”: “INFO”, “message”:”loaded module [x-pack-ccr]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:07.833Z”, “log.level”: “INFO”, “message”:”loaded module [x-pack-core]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:07.833Z”, “log.level”: “INFO”, “message”:”loaded module [x-pack-data-streams]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:07.833Z”, “log.level”: “INFO”, “message”:”loaded module [x-pack-deprecation]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:07.834Z”, “log.level”: “INFO”, “message”:”loaded module [x-pack-enrich]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:07.834Z”, “log.level”: “INFO”, “message”:”loaded module [x-pack-eql]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:07.834Z”, “log.level”: “INFO”, “message”:”loaded module [x-pack-fleet]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:07.834Z”, “log.level”: “INFO”, “message”:”loaded module [x-pack-graph]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:07.834Z”, “log.level”: “INFO”, “message”:”loaded module [x-pack-identity-provider]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:07.835Z”, “log.level”: “INFO”, “message”:”loaded module [x-pack-ilm]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:07.835Z”, “log.level”: “INFO”, “message”:”loaded module [x-pack-logstash]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:07.835Z”, “log.level”: “INFO”, “message”:”loaded module [x-pack-ml]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:07.835Z”, “log.level”: “INFO”, “message”:”loaded module [x-pack-monitoring]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:07.836Z”, “log.level”: “INFO”, “message”:”loaded module [x-pack-ql]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:07.836Z”, “log.level”: “INFO”, “message”:”loaded module [x-pack-rollup]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:07.836Z”, “log.level”: “INFO”, “message”:”loaded module [x-pack-security]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:07.836Z”, “log.level”: “INFO”, “message”:”loaded module [x-pack-shutdown]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:07.837Z”, “log.level”: “INFO”, “message”:”loaded module [x-pack-sql]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:07.837Z”, “log.level”: “INFO”, “message”:”loaded module [x-pack-stack]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:07.838Z”, “log.level”: “INFO”, “message”:”loaded module [x-pack-text-structure]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:07.838Z”, “log.level”: “INFO”, “message”:”loaded module [x-pack-voting-only-node]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:07.838Z”, “log.level”: “INFO”, “message”:”loaded module [x-pack-watcher]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:07.839Z”, “log.level”: “INFO”, “message”:”no plugins loaded”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.plugins.PluginsService”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:07.897Z”, “log.level”: “INFO”, “message”:”using [1] data paths, mounts [[/ (overlay)]], net usable_space [454.7gb], net total_space [491.1gb], types [overlay]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.env.NodeEnvironment”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:07.898Z”, “log.level”: “INFO”, “message”:”heap size [3.8gb], compressed ordinary object pointers [true]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.env.NodeEnvironment”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:07.932Z”, “log.level”: “INFO”, “message”:”node name [fa125dd49687], node ID [DQrTnk6sQMGK_2XKSomHsA], cluster name [docker-cluster], roles [transform, data_hot, ml, data_frozen, ingest, data_cold, data, remote_cluster_client, master, data_warm, data_content]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.node.Node”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:16.469Z”, “log.level”: “INFO”, “message”:”[controller/305] [Main.cc@123] controller (64 bit): Version 8.0.0 (Build 5e85495ea85316) Copyright (c) 2022 Elasticsearch BV”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”ml-cpp-log-tail-thread”,”log.logger”:”org.elasticsearch.xpack.ml.process.logging.CppLogMessageHandler”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:16.707Z”, “log.level”: “INFO”, “message”:”Security is enabled”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.xpack.security.Security”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:17.181Z”, “log.level”: “INFO”, “message”:”license mode is [trial], currently licensed security realms are [reserved/reserved,file/default_file,native/default_native]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.xpack.security.authc.Realms”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:17.192Z”, “log.level”: “INFO”, “message”:”parsed [0] roles from file [/usr/share/elasticsearch/config/roles.yml]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.xpack.security.authz.store.FileRolesStore”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}{“@timestamp”:”2022-02-27T03:36:19.376Z”, “log.level”: “INFO”, “message”:”creating NettyAllocator with the following configs: [name=elasticsearch_configured, chunk_size=1mb, suggested_max_allocation_size=1mb, factors={es.unsafe.use_netty_default_chunk_and_page_size=false, g1gc_enabled=true, g1gc_region_size=4mb}]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.transport.netty4.NettyAllocator”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:19.480Z”, “log.level”: “INFO”, “message”:”using discovery type [zen] and seed hosts providers [settings]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.discovery.DiscoveryModule”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:21.214Z”, “log.level”: “INFO”, “message”:”initialized”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.node.Node”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:21.214Z”, “log.level”: “INFO”, “message”:”starting …”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.node.Node”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:21.233Z”, “log.level”: “INFO”, “message”:”persistent cache index loaded”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.xpack.searchablesnapshots.cache.full.PersistentCache”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:21.234Z”, “log.level”: “INFO”, “message”:”deprecation component started”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.xpack.deprecation.logging.DeprecationIndexingComponent”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:21.356Z”, “log.level”: “INFO”, “message”:”publish_address {10.100.0.10:9300}, bound_addresses {[::]:9300}”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.transport.TransportService”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:21.488Z”, “log.level”: “INFO”, “message”:”bound or publishing to a non-loopback address, enforcing bootstrap checks”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.bootstrap.BootstrapChecks”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:21.501Z”, “log.level”: “INFO”, “message”:”setting initial configuration to VotingConfiguration{DQrTnk6sQMGK_2XKSomHsA}”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.cluster.coordination.Coordinator”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:21.947Z”, “log.level”: “INFO”, “message”:”elected-as-master ([1] nodes joined)[{fa125dd49687}{DQrTnk6sQMGK_2XKSomHsA}{_uofzC5QR8y9CC9GsaKg3g}{10.100.0.10}{10.100.0.10:9300}{cdfhilmrstw} elect leader, _BECOME_MASTER_TASK_, _FINISH_ELECTION_], term: 1, version: 1, delta: master node changed {previous [], current [{fa125dd49687}{DQrTnk6sQMGK_2XKSomHsA}{_uofzC5QR8y9CC9GsaKg3g}{10.100.0.10}{10.100.0.10:9300}{cdfhilmrstw}]}”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”elasticsearch[fa125dd49687][masterService#updateTask][T#1]”,”log.logger”:”org.elasticsearch.cluster.service.MasterService”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:22.160Z”, “log.level”: “INFO”, “message”:”cluster UUID set to [DM2isnPeSjKRfLOimcqTgQ]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”elasticsearch[fa125dd49687][generic][T#4]”,”log.logger”:”org.elasticsearch.cluster.coordination.CoordinationState”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:22.296Z”, “log.level”: “INFO”, “message”:”master node changed {previous [], current [{fa125dd49687}{DQrTnk6sQMGK_2XKSomHsA}{_uofzC5QR8y9CC9GsaKg3g}{10.100.0.10}{10.100.0.10:9300}{cdfhilmrstw}]}, term: 1, version: 1, reason: Publication{term=1, version=1}”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”elasticsearch[fa125dd49687][clusterApplierService#updateTask][T#1]”,”log.logger”:”org.elasticsearch.cluster.service.ClusterApplierService”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:22.414Z”, “log.level”: “INFO”, “message”:”publish_address {10.100.0.10:9200}, bound_addresses {[::]:9200}”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.http.AbstractHttpServerTransport”,”elasticsearch.cluster.uuid”:”DM2isnPeSjKRfLOimcqTgQ”,”elasticsearch.node.id”:”DQrTnk6sQMGK_2XKSomHsA”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:22.415Z”, “log.level”: “INFO”, “message”:”started”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”main”,”log.logger”:”org.elasticsearch.node.Node”,”elasticsearch.cluster.uuid”:”DM2isnPeSjKRfLOimcqTgQ”,”elasticsearch.node.id”:”DQrTnk6sQMGK_2XKSomHsA”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:22.702Z”, “log.level”: “INFO”, “message”:”recovered [0] indices into cluster_state”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”elasticsearch[fa125dd49687][masterService#updateTask][T#1]”,”log.logger”:”org.elasticsearch.gateway.GatewayService”,”elasticsearch.cluster.uuid”:”DM2isnPeSjKRfLOimcqTgQ”,”elasticsearch.node.id”:”DQrTnk6sQMGK_2XKSomHsA”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:23.011Z”, “log.level”: “INFO”, “message”:”adding template [.monitoring-alerts-7] for index patterns [.monitoring-alerts-7]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”elasticsearch[fa125dd49687][masterService#updateTask][T#1]”,”log.logger”:”org.elasticsearch.cluster.metadata.MetadataIndexTemplateService”,”elasticsearch.cluster.uuid”:”DM2isnPeSjKRfLOimcqTgQ”,”elasticsearch.node.id”:”DQrTnk6sQMGK_2XKSomHsA”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:23.127Z”, “log.level”: “INFO”, “message”:”adding template [.monitoring-logstash] for index patterns [.monitoring-logstash-7-*]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”elasticsearch[fa125dd49687][masterService#updateTask][T#1]”,”log.logger”:”org.elasticsearch.cluster.metadata.MetadataIndexTemplateService”,”elasticsearch.cluster.uuid”:”DM2isnPeSjKRfLOimcqTgQ”,”elasticsearch.node.id”:”DQrTnk6sQMGK_2XKSomHsA”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:23.204Z”, “log.level”: “INFO”, “message”:”adding template [.monitoring-kibana] for index patterns [.monitoring-kibana-7-*]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”elasticsearch[fa125dd49687][masterService#updateTask][T#1]”,”log.logger”:”org.elasticsearch.cluster.metadata.MetadataIndexTemplateService”,”elasticsearch.cluster.uuid”:”DM2isnPeSjKRfLOimcqTgQ”,”elasticsearch.node.id”:”DQrTnk6sQMGK_2XKSomHsA”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:23.298Z”, “log.level”: “INFO”, “message”:”adding template [.monitoring-beats] for index patterns [.monitoring-beats-7-*]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”elasticsearch[fa125dd49687][masterService#updateTask][T#1]”,”log.logger”:”org.elasticsearch.cluster.metadata.MetadataIndexTemplateService”,”elasticsearch.cluster.uuid”:”DM2isnPeSjKRfLOimcqTgQ”,”elasticsearch.node.id”:”DQrTnk6sQMGK_2XKSomHsA”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:23.377Z”, “log.level”: “INFO”, “message”:”adding template [.monitoring-es] for index patterns [.monitoring-es-7-*]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”elasticsearch[fa125dd49687][masterService#updateTask][T#1]”,”log.logger”:”org.elasticsearch.cluster.metadata.MetadataIndexTemplateService”,”elasticsearch.cluster.uuid”:”DM2isnPeSjKRfLOimcqTgQ”,”elasticsearch.node.id”:”DQrTnk6sQMGK_2XKSomHsA”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:23.526Z”, “log.level”: “INFO”, “message”:”adding index template [.monitoring-beats-mb] for index patterns [.monitoring-beats-8-*]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”elasticsearch[fa125dd49687][masterService#updateTask][T#1]”,”log.logger”:”org.elasticsearch.cluster.metadata.MetadataIndexTemplateService”,”elasticsearch.cluster.uuid”:”DM2isnPeSjKRfLOimcqTgQ”,”elasticsearch.node.id”:”DQrTnk6sQMGK_2XKSomHsA”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:23.602Z”, “log.level”: “INFO”, “message”:”adding index template [.monitoring-kibana-mb] for index patterns [.monitoring-kibana-8-*]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”elasticsearch[fa125dd49687][masterService#updateTask][T#1]”,”log.logger”:”org.elasticsearch.cluster.metadata.MetadataIndexTemplateService”,”elasticsearch.cluster.uuid”:”DM2isnPeSjKRfLOimcqTgQ”,”elasticsearch.node.id”:”DQrTnk6sQMGK_2XKSomHsA”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:23.700Z”, “log.level”: “INFO”, “message”:”adding index template [.monitoring-logstash-mb] for index patterns [.monitoring-logstash-8-*]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”elasticsearch[fa125dd49687][masterService#updateTask][T#1]”,”log.logger”:”org.elasticsearch.cluster.metadata.MetadataIndexTemplateService”,”elasticsearch.cluster.uuid”:”DM2isnPeSjKRfLOimcqTgQ”,”elasticsearch.node.id”:”DQrTnk6sQMGK_2XKSomHsA”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:23.965Z”, “log.level”: “INFO”, “message”:”adding index template [.monitoring-es-mb] for index patterns [.monitoring-es-8-*]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”elasticsearch[fa125dd49687][masterService#updateTask][T#1]”,”log.logger”:”org.elasticsearch.cluster.metadata.MetadataIndexTemplateService”,”elasticsearch.cluster.uuid”:”DM2isnPeSjKRfLOimcqTgQ”,”elasticsearch.node.id”:”DQrTnk6sQMGK_2XKSomHsA”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:24.122Z”, “log.level”: “INFO”, “message”:”adding index template [.ml-anomalies-] for index patterns [.ml-anomalies-*]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”elasticsearch[fa125dd49687][masterService#updateTask][T#1]”,”log.logger”:”org.elasticsearch.cluster.metadata.MetadataIndexTemplateService”,”elasticsearch.cluster.uuid”:”DM2isnPeSjKRfLOimcqTgQ”,”elasticsearch.node.id”:”DQrTnk6sQMGK_2XKSomHsA”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:24.204Z”, “log.level”: “INFO”, “message”:”adding index template [.ml-state] for index patterns [.ml-state*]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”elasticsearch[fa125dd49687][masterService#updateTask][T#1]”,”log.logger”:”org.elasticsearch.cluster.metadata.MetadataIndexTemplateService”,”elasticsearch.cluster.uuid”:”DM2isnPeSjKRfLOimcqTgQ”,”elasticsearch.node.id”:”DQrTnk6sQMGK_2XKSomHsA”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:24.280Z”, “log.level”: “INFO”, “message”:”adding component template [synthetics-mappings]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”elasticsearch[fa125dd49687][masterService#updateTask][T#1]”,”log.logger”:”org.elasticsearch.cluster.metadata.MetadataIndexTemplateService”,”elasticsearch.cluster.uuid”:”DM2isnPeSjKRfLOimcqTgQ”,”elasticsearch.node.id”:”DQrTnk6sQMGK_2XKSomHsA”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:24.342Z”, “log.level”: “INFO”, “message”:”adding component template [metrics-settings]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”elasticsearch[fa125dd49687][masterService#updateTask][T#1]”,”log.logger”:”org.elasticsearch.cluster.metadata.MetadataIndexTemplateService”,”elasticsearch.cluster.uuid”:”DM2isnPeSjKRfLOimcqTgQ”,”elasticsearch.node.id”:”DQrTnk6sQMGK_2XKSomHsA”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:24.411Z”, “log.level”: “INFO”, “message”:”adding component template [data-streams-mappings]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”elasticsearch[fa125dd49687][masterService#updateTask][T#1]”,”log.logger”:”org.elasticsearch.cluster.metadata.MetadataIndexTemplateService”,”elasticsearch.cluster.uuid”:”DM2isnPeSjKRfLOimcqTgQ”,”elasticsearch.node.id”:”DQrTnk6sQMGK_2XKSomHsA”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:24.474Z”, “log.level”: “INFO”, “message”:”adding component template [logs-settings]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”elasticsearch[fa125dd49687][masterService#updateTask][T#1]”,”log.logger”:”org.elasticsearch.cluster.metadata.MetadataIndexTemplateService”,”elasticsearch.cluster.uuid”:”DM2isnPeSjKRfLOimcqTgQ”,”elasticsearch.node.id”:”DQrTnk6sQMGK_2XKSomHsA”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:24.538Z”, “log.level”: “INFO”, “message”:”adding component template [metrics-mappings]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”elasticsearch[fa125dd49687][masterService#updateTask][T#1]”,”log.logger”:”org.elasticsearch.cluster.metadata.MetadataIndexTemplateService”,”elasticsearch.cluster.uuid”:”DM2isnPeSjKRfLOimcqTgQ”,”elasticsearch.node.id”:”DQrTnk6sQMGK_2XKSomHsA”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:24.600Z”, “log.level”: “INFO”, “message”:”adding component template [synthetics-settings]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”elasticsearch[fa125dd49687][masterService#updateTask][T#1]”,”log.logger”:”org.elasticsearch.cluster.metadata.MetadataIndexTemplateService”,”elasticsearch.cluster.uuid”:”DM2isnPeSjKRfLOimcqTgQ”,”elasticsearch.node.id”:”DQrTnk6sQMGK_2XKSomHsA”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:24.661Z”, “log.level”: “INFO”, “message”:”adding component template [logs-mappings]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”elasticsearch[fa125dd49687][masterService#updateTask][T#1]”,”log.logger”:”org.elasticsearch.cluster.metadata.MetadataIndexTemplateService”,”elasticsearch.cluster.uuid”:”DM2isnPeSjKRfLOimcqTgQ”,”elasticsearch.node.id”:”DQrTnk6sQMGK_2XKSomHsA”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:24.720Z”, “log.level”: “INFO”, “message”:”adding index template [.ml-notifications-000002] for index patterns [.ml-notifications-000002]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”elasticsearch[fa125dd49687][masterService#updateTask][T#1]”,”log.logger”:”org.elasticsearch.cluster.metadata.MetadataIndexTemplateService”,”elasticsearch.cluster.uuid”:”DM2isnPeSjKRfLOimcqTgQ”,”elasticsearch.node.id”:”DQrTnk6sQMGK_2XKSomHsA”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:24.776Z”, “log.level”: “INFO”, “message”:”adding index template [.ml-stats] for index patterns [.ml-stats-*]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”elasticsearch[fa125dd49687][masterService#updateTask][T#1]”,”log.logger”:”org.elasticsearch.cluster.metadata.MetadataIndexTemplateService”,”elasticsearch.cluster.uuid”:”DM2isnPeSjKRfLOimcqTgQ”,”elasticsearch.node.id”:”DQrTnk6sQMGK_2XKSomHsA”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:24.948Z”, “log.level”: “INFO”, “message”:”adding index template [ilm-history] for index patterns [ilm-history-5*]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”elasticsearch[fa125dd49687][masterService#updateTask][T#1]”,”log.logger”:”org.elasticsearch.cluster.metadata.MetadataIndexTemplateService”,”elasticsearch.cluster.uuid”:”DM2isnPeSjKRfLOimcqTgQ”,”elasticsearch.node.id”:”DQrTnk6sQMGK_2XKSomHsA”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:25.046Z”, “log.level”: “INFO”, “message”:”adding index template [.watch-history-16] for index patterns [.watcher-history-16*]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”elasticsearch[fa125dd49687][masterService#updateTask][T#1]”,”log.logger”:”org.elasticsearch.cluster.metadata.MetadataIndexTemplateService”,”elasticsearch.cluster.uuid”:”DM2isnPeSjKRfLOimcqTgQ”,”elasticsearch.node.id”:”DQrTnk6sQMGK_2XKSomHsA”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:25.134Z”, “log.level”: “INFO”, “message”:”adding index template [.slm-history] for index patterns [.slm-history-5*]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”elasticsearch[fa125dd49687][masterService#updateTask][T#1]”,”log.logger”:”org.elasticsearch.cluster.metadata.MetadataIndexTemplateService”,”elasticsearch.cluster.uuid”:”DM2isnPeSjKRfLOimcqTgQ”,”elasticsearch.node.id”:”DQrTnk6sQMGK_2XKSomHsA”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:25.199Z”, “log.level”: “INFO”, “message”:”adding component template [.deprecation-indexing-mappings]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”elasticsearch[fa125dd49687][masterService#updateTask][T#1]”,”log.logger”:”org.elasticsearch.cluster.metadata.MetadataIndexTemplateService”,”elasticsearch.cluster.uuid”:”DM2isnPeSjKRfLOimcqTgQ”,”elasticsearch.node.id”:”DQrTnk6sQMGK_2XKSomHsA”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:25.252Z”, “log.level”: “INFO”, “message”:”adding component template [.deprecation-indexing-settings]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”elasticsearch[fa125dd49687][masterService#updateTask][T#1]”,”log.logger”:”org.elasticsearch.cluster.metadata.MetadataIndexTemplateService”,”elasticsearch.cluster.uuid”:”DM2isnPeSjKRfLOimcqTgQ”,”elasticsearch.node.id”:”DQrTnk6sQMGK_2XKSomHsA”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:25.307Z”, “log.level”: “INFO”, “message”:”adding index template [metrics] for index patterns [metrics-*-*]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”elasticsearch[fa125dd49687][masterService#updateTask][T#1]”,”log.logger”:”org.elasticsearch.cluster.metadata.MetadataIndexTemplateService”,”elasticsearch.cluster.uuid”:”DM2isnPeSjKRfLOimcqTgQ”,”elasticsearch.node.id”:”DQrTnk6sQMGK_2XKSomHsA”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:25.369Z”, “log.level”: “INFO”, “message”:”adding index template [synthetics] for index patterns [synthetics-*-*]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”elasticsearch[fa125dd49687][masterService#updateTask][T#1]”,”log.logger”:”org.elasticsearch.cluster.metadata.MetadataIndexTemplateService”,”elasticsearch.cluster.uuid”:”DM2isnPeSjKRfLOimcqTgQ”,”elasticsearch.node.id”:”DQrTnk6sQMGK_2XKSomHsA”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:25.428Z”, “log.level”: “INFO”, “message”:”adding index template [logs] for index patterns [logs-*-*]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”elasticsearch[fa125dd49687][masterService#updateTask][T#1]”,”log.logger”:”org.elasticsearch.cluster.metadata.MetadataIndexTemplateService”,”elasticsearch.cluster.uuid”:”DM2isnPeSjKRfLOimcqTgQ”,”elasticsearch.node.id”:”DQrTnk6sQMGK_2XKSomHsA”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:25.488Z”, “log.level”: “INFO”, “message”:”adding index template [.deprecation-indexing-template] for index patterns [.logs-deprecation.*]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”elasticsearch[fa125dd49687][masterService#updateTask][T#1]”,”log.logger”:”org.elasticsearch.cluster.metadata.MetadataIndexTemplateService”,”elasticsearch.cluster.uuid”:”DM2isnPeSjKRfLOimcqTgQ”,”elasticsearch.node.id”:”DQrTnk6sQMGK_2XKSomHsA”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:25.542Z”, “log.level”: “INFO”, “message”:”adding index lifecycle policy [.monitoring-8-ilm-policy]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”elasticsearch[fa125dd49687][masterService#updateTask][T#1]”,”log.logger”:”org.elasticsearch.xpack.ilm.action.TransportPutLifecycleAction”,”elasticsearch.cluster.uuid”:”DM2isnPeSjKRfLOimcqTgQ”,”elasticsearch.node.id”:”DQrTnk6sQMGK_2XKSomHsA”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:25.616Z”, “log.level”: “INFO”, “message”:”adding index lifecycle policy [ml-size-based-ilm-policy]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”elasticsearch[fa125dd49687][masterService#updateTask][T#1]”,”log.logger”:”org.elasticsearch.xpack.ilm.action.TransportPutLifecycleAction”,”elasticsearch.cluster.uuid”:”DM2isnPeSjKRfLOimcqTgQ”,”elasticsearch.node.id”:”DQrTnk6sQMGK_2XKSomHsA”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:25.669Z”, “log.level”: “INFO”, “message”:”adding index lifecycle policy [metrics]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”elasticsearch[fa125dd49687][masterService#updateTask][T#1]”,”log.logger”:”org.elasticsearch.xpack.ilm.action.TransportPutLifecycleAction”,”elasticsearch.cluster.uuid”:”DM2isnPeSjKRfLOimcqTgQ”,”elasticsearch.node.id”:”DQrTnk6sQMGK_2XKSomHsA”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:25.718Z”, “log.level”: “INFO”, “message”:”adding index lifecycle policy [logs]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”elasticsearch[fa125dd49687][masterService#updateTask][T#1]”,”log.logger”:”org.elasticsearch.xpack.ilm.action.TransportPutLifecycleAction”,”elasticsearch.cluster.uuid”:”DM2isnPeSjKRfLOimcqTgQ”,”elasticsearch.node.id”:”DQrTnk6sQMGK_2XKSomHsA”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:25.775Z”, “log.level”: “INFO”, “message”:”adding index lifecycle policy [synthetics]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”elasticsearch[fa125dd49687][masterService#updateTask][T#1]”,”log.logger”:”org.elasticsearch.xpack.ilm.action.TransportPutLifecycleAction”,”elasticsearch.cluster.uuid”:”DM2isnPeSjKRfLOimcqTgQ”,”elasticsearch.node.id”:”DQrTnk6sQMGK_2XKSomHsA”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:25.826Z”, “log.level”: “INFO”, “message”:”adding index lifecycle policy [7-days-default]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”elasticsearch[fa125dd49687][masterService#updateTask][T#1]”,”log.logger”:”org.elasticsearch.xpack.ilm.action.TransportPutLifecycleAction”,”elasticsearch.cluster.uuid”:”DM2isnPeSjKRfLOimcqTgQ”,”elasticsearch.node.id”:”DQrTnk6sQMGK_2XKSomHsA”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:25.886Z”, “log.level”: “INFO”, “message”:”adding index lifecycle policy [30-days-default]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”elasticsearch[fa125dd49687][masterService#updateTask][T#1]”,”log.logger”:”org.elasticsearch.xpack.ilm.action.TransportPutLifecycleAction”,”elasticsearch.cluster.uuid”:”DM2isnPeSjKRfLOimcqTgQ”,”elasticsearch.node.id”:”DQrTnk6sQMGK_2XKSomHsA”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:25.936Z”, “log.level”: “INFO”, “message”:”adding index lifecycle policy [365-days-default]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”elasticsearch[fa125dd49687][masterService#updateTask][T#1]”,”log.logger”:”org.elasticsearch.xpack.ilm.action.TransportPutLifecycleAction”,”elasticsearch.cluster.uuid”:”DM2isnPeSjKRfLOimcqTgQ”,”elasticsearch.node.id”:”DQrTnk6sQMGK_2XKSomHsA”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:25.987Z”, “log.level”: “INFO”, “message”:”adding index lifecycle policy [90-days-default]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”elasticsearch[fa125dd49687][masterService#updateTask][T#1]”,”log.logger”:”org.elasticsearch.xpack.ilm.action.TransportPutLifecycleAction”,”elasticsearch.cluster.uuid”:”DM2isnPeSjKRfLOimcqTgQ”,”elasticsearch.node.id”:”DQrTnk6sQMGK_2XKSomHsA”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:26.057Z”, “log.level”: “INFO”, “message”:”adding index lifecycle policy [180-days-default]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”elasticsearch[fa125dd49687][masterService#updateTask][T#1]”,”log.logger”:”org.elasticsearch.xpack.ilm.action.TransportPutLifecycleAction”,”elasticsearch.cluster.uuid”:”DM2isnPeSjKRfLOimcqTgQ”,”elasticsearch.node.id”:”DQrTnk6sQMGK_2XKSomHsA”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:26.108Z”, “log.level”: “INFO”, “message”:”adding index lifecycle policy [watch-history-ilm-policy-16]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”elasticsearch[fa125dd49687][masterService#updateTask][T#1]”,”log.logger”:”org.elasticsearch.xpack.ilm.action.TransportPutLifecycleAction”,”elasticsearch.cluster.uuid”:”DM2isnPeSjKRfLOimcqTgQ”,”elasticsearch.node.id”:”DQrTnk6sQMGK_2XKSomHsA”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:26.158Z”, “log.level”: “INFO”, “message”:”adding index lifecycle policy [ilm-history-ilm-policy]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”elasticsearch[fa125dd49687][masterService#updateTask][T#1]”,”log.logger”:”org.elasticsearch.xpack.ilm.action.TransportPutLifecycleAction”,”elasticsearch.cluster.uuid”:”DM2isnPeSjKRfLOimcqTgQ”,”elasticsearch.node.id”:”DQrTnk6sQMGK_2XKSomHsA”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:26.203Z”, “log.level”: “INFO”, “message”:”adding index lifecycle policy [slm-history-ilm-policy]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”elasticsearch[fa125dd49687][masterService#updateTask][T#1]”,”log.logger”:”org.elasticsearch.xpack.ilm.action.TransportPutLifecycleAction”,”elasticsearch.cluster.uuid”:”DM2isnPeSjKRfLOimcqTgQ”,”elasticsearch.node.id”:”DQrTnk6sQMGK_2XKSomHsA”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:26.247Z”, “log.level”: “INFO”, “message”:”adding index lifecycle policy [.fleet-actions-results-ilm-policy]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”elasticsearch[fa125dd49687][masterService#updateTask][T#1]”,”log.logger”:”org.elasticsearch.xpack.ilm.action.TransportPutLifecycleAction”,”elasticsearch.cluster.uuid”:”DM2isnPeSjKRfLOimcqTgQ”,”elasticsearch.node.id”:”DQrTnk6sQMGK_2XKSomHsA”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:26.293Z”, “log.level”: “INFO”, “message”:”adding index lifecycle policy [.deprecation-indexing-ilm-policy]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”elasticsearch[fa125dd49687][masterService#updateTask][T#1]”,”log.logger”:”org.elasticsearch.xpack.ilm.action.TransportPutLifecycleAction”,”elasticsearch.cluster.uuid”:”DM2isnPeSjKRfLOimcqTgQ”,”elasticsearch.node.id”:”DQrTnk6sQMGK_2XKSomHsA”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:26.444Z”, “log.level”: “INFO”, “message”:”license [bf77bb6e-c0ed-49c9-9f25-6f9225872c95] mode [basic] – valid”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”elasticsearch[fa125dd49687][clusterApplierService#updateTask][T#1]”,”log.logger”:”org.elasticsearch.license.LicenseService”,”elasticsearch.cluster.uuid”:”DM2isnPeSjKRfLOimcqTgQ”,”elasticsearch.node.id”:”DQrTnk6sQMGK_2XKSomHsA”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:26.445Z”, “log.level”: “INFO”, “message”:”license mode is [basic], currently licensed security realms are [reserved/reserved,file/default_file,native/default_native]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”elasticsearch[fa125dd49687][clusterApplierService#updateTask][T#1]”,”log.logger”:”org.elasticsearch.xpack.security.authc.Realms”,”elasticsearch.cluster.uuid”:”DM2isnPeSjKRfLOimcqTgQ”,”elasticsearch.node.id”:”DQrTnk6sQMGK_2XKSomHsA”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:27.325Z”, “log.level”: “INFO”, “message”:”[.geoip_databases] creating index, cause [auto(bulk api)], templates [], shards [1]/[0]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”elasticsearch[fa125dd49687][masterService#updateTask][T#1]”,”log.logger”:”org.elasticsearch.cluster.metadata.MetadataCreateIndexService”,”elasticsearch.cluster.uuid”:”DM2isnPeSjKRfLOimcqTgQ”,”elasticsearch.node.id”:”DQrTnk6sQMGK_2XKSomHsA”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:27.587Z”, “log.level”: “INFO”, “current.health”:”GREEN”,”message”:”Cluster health status changed from [YELLOW] to [GREEN] (reason: [shards started [[.geoip_databases][0]]]).”,”previous.health”:”YELLOW”,”reason”:”shards started [[.geoip_databases][0]]” , “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”elasticsearch[fa125dd49687][masterService#updateTask][T#1]”,”log.logger”:”org.elasticsearch.cluster.routing.allocation.AllocationService”,”elasticsearch.cluster.uuid”:”DM2isnPeSjKRfLOimcqTgQ”,”elasticsearch.node.id”:”DQrTnk6sQMGK_2XKSomHsA”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:28.250Z”, “log.level”: “INFO”, “message”:”successfully downloaded geoip database [GeoLite2-ASN.mmdb]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”elasticsearch[fa125dd49687][generic][T#6]”,”log.logger”:”org.elasticsearch.ingest.geoip.GeoIpDownloader”,”elasticsearch.cluster.uuid”:”DM2isnPeSjKRfLOimcqTgQ”,”elasticsearch.node.id”:”DQrTnk6sQMGK_2XKSomHsA”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:28.502Z”, “log.level”: “INFO”, “message”:”successfully loaded geoip database file [GeoLite2-ASN.mmdb]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”elasticsearch[fa125dd49687][generic][T#1]”,”log.logger”:”org.elasticsearch.ingest.geoip.DatabaseNodeService”,”elasticsearch.cluster.uuid”:”DM2isnPeSjKRfLOimcqTgQ”,”elasticsearch.node.id”:”DQrTnk6sQMGK_2XKSomHsA”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:30.677Z”, “log.level”: “INFO”, “message”:”successfully downloaded geoip database [GeoLite2-City.mmdb]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”elasticsearch[fa125dd49687][generic][T#6]”,”log.logger”:”org.elasticsearch.ingest.geoip.GeoIpDownloader”,”elasticsearch.cluster.uuid”:”DM2isnPeSjKRfLOimcqTgQ”,”elasticsearch.node.id”:”DQrTnk6sQMGK_2XKSomHsA”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:31.091Z”, “log.level”: “INFO”, “message”:”successfully downloaded geoip database [GeoLite2-Country.mmdb]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”elasticsearch[fa125dd49687][generic][T#6]”,”log.logger”:”org.elasticsearch.ingest.geoip.GeoIpDownloader”,”elasticsearch.cluster.uuid”:”DM2isnPeSjKRfLOimcqTgQ”,”elasticsearch.node.id”:”DQrTnk6sQMGK_2XKSomHsA”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:31.205Z”, “log.level”: “INFO”, “message”:”successfully loaded geoip database file [GeoLite2-Country.mmdb]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”elasticsearch[fa125dd49687][generic][T#4]”,”log.logger”:”org.elasticsearch.ingest.geoip.DatabaseNodeService”,”elasticsearch.cluster.uuid”:”DM2isnPeSjKRfLOimcqTgQ”,”elasticsearch.node.id”:”DQrTnk6sQMGK_2XKSomHsA”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:31.767Z”, “log.level”: “INFO”, “message”:”HTTPS has been configured with automatically generated certificates, and the CA’s hex-encoded SHA-256 fingerprint is [b13d0a43a5e689f4b00fce8df417e0e383e5b9837ec2505ea1521f659a90d0b8]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”elasticsearch[fa125dd49687][generic][T#9]”,”log.logger”:”org.elasticsearch.xpack.security.InitialNodeSecurityAutoConfiguration”,”elasticsearch.cluster.uuid”:”DM2isnPeSjKRfLOimcqTgQ”,”elasticsearch.node.id”:”DQrTnk6sQMGK_2XKSomHsA”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:31.769Z”, “log.level”: “INFO”, “message”:”security index does not exist, creating [.security-7] with alias [.security]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”elasticsearch[fa125dd49687][generic][T#9]”,”log.logger”:”org.elasticsearch.xpack.security.support.SecurityIndexManager”,”elasticsearch.cluster.uuid”:”DM2isnPeSjKRfLOimcqTgQ”,”elasticsearch.node.id”:”DQrTnk6sQMGK_2XKSomHsA”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:31.812Z”, “log.level”: “INFO”, “message”:”successfully loaded geoip database file [GeoLite2-City.mmdb]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”elasticsearch[fa125dd49687][generic][T#2]”,”log.logger”:”org.elasticsearch.ingest.geoip.DatabaseNodeService”,”elasticsearch.cluster.uuid”:”DM2isnPeSjKRfLOimcqTgQ”,”elasticsearch.node.id”:”DQrTnk6sQMGK_2XKSomHsA”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:31.924Z”, “log.level”: “INFO”, “message”:”[.security-7] creating index, cause [api], templates [], shards [1]/[0]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”elasticsearch[fa125dd49687][masterService#updateTask][T#1]”,”log.logger”:”org.elasticsearch.cluster.metadata.MetadataCreateIndexService”,”elasticsearch.cluster.uuid”:”DM2isnPeSjKRfLOimcqTgQ”,”elasticsearch.node.id”:”DQrTnk6sQMGK_2XKSomHsA”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:31.946Z”, “log.level”: “INFO”, “message”:”security index does not exist, creating [.security-7] with alias [.security]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”elasticsearch[fa125dd49687][security-crypto][T#1]”,”log.logger”:”org.elasticsearch.xpack.security.support.SecurityIndexManager”,”elasticsearch.cluster.uuid”:”DM2isnPeSjKRfLOimcqTgQ”,”elasticsearch.node.id”:”DQrTnk6sQMGK_2XKSomHsA”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:31.949Z”, “log.level”: “INFO”, “message”:”security index does not exist, creating [.security-7] with alias [.security]”, “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”elasticsearch[fa125dd49687][security-crypto][T#2]”,”log.logger”:”org.elasticsearch.xpack.security.support.SecurityIndexManager”,”elasticsearch.cluster.uuid”:”DM2isnPeSjKRfLOimcqTgQ”,”elasticsearch.node.id”:”DQrTnk6sQMGK_2XKSomHsA”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}
{“@timestamp”:”2022-02-27T03:36:32.029Z”, “log.level”: “INFO”, “current.health”:”GREEN”,”message”:”Cluster health status changed from [YELLOW] to [GREEN] (reason: [shards started [[.security-7][0]]]).”,”previous.health”:”YELLOW”,”reason”:”shards started [[.security-7][0]]” , “ecs.version”: “1.2.0”,”service.name”:”ES_ECS”,”event.dataset”:”elasticsearch.server”,”process.thread.name”:”elasticsearch[fa125dd49687][masterService#updateTask][T#1]”,”log.logger”:”org.elasticsearch.cluster.routing.allocation.AllocationService”,”elasticsearch.cluster.uuid”:”DM2isnPeSjKRfLOimcqTgQ”,”elasticsearch.node.id”:”DQrTnk6sQMGK_2XKSomHsA”,”elasticsearch.node.name”:”fa125dd49687″,”elasticsearch.cluster.name”:”docker-cluster”}

————————————————————————————————————————————————————————————–
-> Elasticsearch security features have been automatically configured!
-> Authentication is enabled and cluster connections are encrypted.

-> Password for the elastic user (reset with `bin/elasticsearch-reset-password -u elastic`):
5xxxxxxxxxxxxxxxxxxZ

-> HTTP CA certificate SHA-256 fingerprint:
bxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx8

-> Configure Kibana to use this cluster:
* Run Kibana and click the configuration link in the terminal when Kibana starts.
* Copy the following enrollment token and paste it into Kibana in your browser (valid for the next 30 minutes):
eyxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxn0=

-> Configure other nodes to join this cluster:
* Copy the following enrollment token and start new Elasticsearch nodes with `bin/elasticsearch –enrollment-token ` (valid for the next 30 minutes):
eyxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxn0=

If you’re running in Docker, copy the enrollment token and run:
`docker run -e “ENROLLMENT_TOKEN=” docker.elastic.co/elasticsearch/elasticsearch:8.0.0`
————————————————————————————————————————————————————————————–

在启动消息的中间，密码和令牌信息会被输出，所以请将其记录在安全的地方。
（在上面的示例中，部分使用xxxxx进行了安全处理）
按下Ctrl+P，然后按下Ctrl+Q，即可使容器在后台运行并退出控制台。

为了确保，我们将检查所指定的IP地址是否已被分配。

[elkusr01@ISEI20220214-2245-natural-2 ~]$ podman inspect es01 | grep IPAddress
            "IPAddress": "",
                    "IPAddress": "10.100.0.10",

由于此IP地址是用于内部网络的，所以在外部连接时无需特别考虑。

获得 CA 证书

将在容器上生成的CA证书复制到主机上。

验证证书路径

[elkusr01@ISEI20220214-2245-natural-2 ~]$ podman exec -it es01 /bin/bash -c "find /usr/share/elasticsearch -name http_ca.crt"
/usr/share/elasticsearch/config/certs/http_ca.crt

将副本复制到主机上

[elkusr01@ISEI20220214-2245-natural-2 ~]$ mkdir ElasticsearchCert
[elkusr01@ISEI20220214-2245-natural-2 ~]$ cd ElasticsearchCert/
[elkusr01@ISEI20220214-2245-natural-2 ~/ElasticsearchCert]$ podman cp es01:/usr/share/elasticsearch/config/certs/http_ca.crt .
[elkusr01@ISEI20220214-2245-natural-2 ~/ElasticsearchCert]$ ls -la
total 12
drwx------. 2 elkusr01 elkusr01 4096 Feb 27 12:38 .
drwx------. 6 elkusr01 elkusr01 4096 Feb 27 12:38 ..
-rw-rw----. 1 elkusr01 elkusr01 1915 Feb 27 12:35 http_ca.crt

确认连接到Elasticsearch

我尝试使用curl连接到Elasticsearch。※请输入在启动Elasticsearch时显示的密码。

[elkusr01@ISEI20220214-2245-natural-2 ~/ElasticsearchCert]$ curl --cacert http_ca.crt -u elastic https://localhost:9200
Enter host password for user 'elastic':
{
  "name" : "fa125dd49687",
  "cluster_name" : "docker-cluster",
  "cluster_uuid" : "DM2isnPeSjKRfLOimcqTgQ",
  "version" : {
    "number" : "8.0.0",
    "build_flavor" : "default",
    "build_type" : "docker",
    "build_hash" : "1b6a7ece17463df5ff54a3e1302d825889aa1161",
    "build_date" : "2022-02-03T16:47:57.507843096Z",
    "build_snapshot" : false,
    "lucene_version" : "9.0.0",
    "minimum_wire_compatibility_version" : "7.17.0",
    "minimum_index_compatibility_version" : "7.0.0"
  },
  "tagline" : "You Know, for Search"
}

根据Elasticsearch返回的信息，连接似乎是正常的。

创建/启动 Kibana容器

这里也会使用明确指定的IP地址来创建容器。

命令：podman运行 –name kibana –net elastic –ip 10.100.0.20 -p 5601:5601 docker.elastic.co/kibana/kibana:8.0.0

[elkusr01@ISEI20220214-2245-natural-2 ~]$ podman run --name kibana --net elastic --ip 10.100.0.20 -p 5601:5601 docker.elastic.co/kibana/kibana:8.0.0
[2022-02-27T03:41:01.652+00:00][INFO ][plugins-service] Plugin "metricsEntities" is disabled.
[2022-02-27T03:41:01.783+00:00][INFO ][http.server.Preboot] http server running at http://0.0.0.0:5601
[2022-02-27T03:41:01.838+00:00][INFO ][plugins-system.preboot] Setting up [1] plugins: [interactiveSetup]
[2022-02-27T03:41:01.841+00:00][INFO ][preboot] "interactiveSetup" plugin is holding setup: Validating Elasticsearch connection configuration…
[2022-02-27T03:41:01.885+00:00][INFO ][root] Holding setup until preboot stage is completed.


i Kibana has not been configured.

Go to http://0.0.0.0:5601/?code=139832 to get started.

我会让控制台保持不变，不从容器中退出。

我会检查通过其他窗口指定的IP地址是否已分配。

[elkusr01@ISEI20220214-2245-natural-2 ~]$ podman inspect kibana | grep IPAddress
            "IPAddress": "",
                    "IPAddress": "10.100.0.20",

Kibana的配置

我們使用瀏覽器訪問Kibana。

当您输入令牌时，Elasticsearch的访问地址将显示在其下方。这意味着目标信息被嵌入到该令牌中。

在这里，当我们回到Kibana容器的控制台上时，会发现输出如下（※xxx xxx是一个6位数字）。

Your verification code is:  xxx xxx

这样应该已经完成了基本的结构。

开始/停止 /

可以按照以下方式进行启动/停止。

启动

[elkusr01@ISEI20220214-2245-natural-2 ~]$ podman start es01
es01
[elkusr01@ISEI20220214-2245-natural-2 ~]$ podman start kibana
kibana

[elkusr01@ISEI20220214-2245-natural-2 ~]$ podman ps
CONTAINER ID  IMAGE                                                COMMAND               CREATED         STATUS                 PORTS                   NAMES
fa125dd49687  docker.elastic.co/elasticsearch/elasticsearch:8.0.0  eswrapper             17 minutes ago  Up 2 minutes ago       0.0.0.0:9200->9200/tcp  es01
d06c050d2983  docker.elastic.co/kibana/kibana:8.0.0                /usr/local/bin/ki...  12 minutes ago  Up About a minute ago  0.0.0.0:5601->5601/tcp  kibana

停止: 停下。

[elkusr01@ISEI20220214-2245-natural-2 ~]$ podman stop kibana
kibana
[elkusr01@ISEI20220214-2245-natural-2 ~]$ podman stop es01
es01

[elkusr01@ISEI20220214-2245-natural-2 ~]$ podman ps -a
CONTAINER ID  IMAGE                                                COMMAND               CREATED         STATUS                      PORTS                   NAMES
fa125dd49687  docker.elastic.co/elasticsearch/elasticsearch:8.0.0  eswrapper             18 minutes ago  Exited (143) 3 seconds ago  0.0.0.0:9200->9200/tcp  es01
d06c050d2983  docker.elastic.co/kibana/kibana:8.0.0                /usr/local/bin/ki...  13 minutes ago  Exited (0) 11 seconds ago   0.0.0.0:5601->5601/tcp  kibana