Elasticsearch ignoring, rejecting requests

0

Hello,

Approximately 10 days ago my elasticsearch cluster stopped accepting new documents to some indices.

I am writing log data to elasticsearch from an ECS task using https://github.com/internetitem/logback-elasticsearch-appender, which formats log messages for submission to the Elasticsearch /_bulk REST API. I am using the AWS java SDK version 1.11.632 to access the default credential provider chain and sign requests. The task is assigned a specific task role in the task definition, and this role has been added explicitly to my ES domain's access policy.

The ES cluster is managed in a "shared" AWS account while the ECS task is running in a separate "dev" account. The domain name is "logs".

The access policy looks like this (account numbers redacted)

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": [
          "arn:aws:iam::DEV_ACCT_NUM:role/ecsTaskExecutionRole",
          "arn:aws:iam::DEV_ACCT_NUM:role/MyTaskRole"
          //Plus some more roles for other tasks
        ]
      },
      "Action": "es:*",
      "Resource": "arn:aws:es:ca-central-1:SHARED_ACCT_NUM:domain/logs/*"
    },
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::SHARED_ACCT_NUM:role/Cognito_Kibana_IdentitiesAuth_Role"
      },
      "Action": "*",
      "Resource": "arn:aws:es:ca-central-1:SHARED_ACCT_NUM:*"
    }
  ]
}

Logs are written to an index named {environment}-{date}, e.g. "dev-2020-04-23". I expect that if the so named index doesn't exist it will be created when I write to it. This has worked so far.

THE PROBLEM:
When I write to ES, I sometimes receive a 403 response indicating that the request signature is invalid. Nothing has changed about the way I retrieve credentials or sign requests, nor has my access policy changed.

More often the response is 200 OK, but the logs do not appear in Kibana and the index does not appear in the AWS management console.

I can still write to existing indices which leads me to believe the problem is in creating new indices and not in writing documents. I was not able to find any documented limit to the number of indices.

This behaviour was first observed when the cluster was ES version 7.1. Upgrading to 7.4 did not help.

Thanks in advance for any assistance.

已提問 4 年前檢視次數 215 次
1 個回答
0

This has been solved. While there's no limit on the number of indices there is a limit on the number of shards per data node. If creating an index would require more shards than the limit Elasticsearch allegedly fails with an error. AWS swallows this error and returns success when the _bulk API is used.

Manually deleting some old indices has resolved the issue.

已回答 4 年前

您尚未登入。 登入 去張貼答案。

一個好的回答可以清楚地回答問題並提供建設性的意見回饋,同時有助於提問者的專業成長。

回答問題指南