什么是 Elastic APM 中的输出错误？

Answer 1

Beat 系列工具使用的 Libbeat 代码内部：

    //
    // Output event stats
    //
    batches *monitoring.Uint // total number of batches processed by output
    events  *monitoring.Uint // total number of events processed by output

    acked      *monitoring.Uint // total number of events ACKed by output
    failed     *monitoring.Uint // total number of events failed in output
    active     *monitoring.Uint // events sent and waiting for ACK/fail from output
    duplicates *monitoring.Uint // events sent and waiting for ACK/fail from output
    dropped    *monitoring.Uint // total number of invalid events dropped by the output
    tooMany    *monitoring.Uint // total number of too many requests replies from output

    //
    // Output network connection stats
    //
    writeBytes  *monitoring.Uint // total amount of bytes written by output
    writeErrors *monitoring.Uint // total number of errors on write

    readBytes  *monitoring.Uint // total amount of bytes read
    readErrors *monitoring.Uint // total number of errors while waiting for response on output
}

当您在 Elastic 中查询 Libbeat 的结果时（见下文），输出错误源自初始时间戳的 readErrors + writeErrors 和最新时间​​戳的 readErrors + writeErrors 之间的measured delta。根据当时的代码注释，Output Errors 是出现错误的网络数据包的数量。

下面的示例使用 apm-server 作为节拍类型，但您可以根据需要替换它。它不会给你为什么您遇到网络错误，但它会拆分数据，以便您识别它是读取错误还是写入错误。

    "query": {
      "bool": {
        "filter": [
          {
            "bool": {
              "should": [
                {
                  "term": {
                    "data_stream.dataset": "beats.stats"
                  }
                },
                {
                  "term": {
                    "metricset.name": "stats"
                  }
                },
                {
                  "term": {
                    "type": "beats_stats"
                  }
                }
              ]
            }
          },
          {
            "term": {
              "cluster_uuid": "CLUSTER_UUID"
            }
          },
          {
            "range": {
              "beats_stats.timestamp": {
                "format": "epoch_millis",
                "gte": 1665053615330,
                "lte": 1665054515330
              }
            }
          },
          {
            "bool": {
              "must": {
                "term": {
                  "beats_stats.beat.type": "apm-server"
                }
              }
            }
          }
        ]
      }
    },
    "collapse": {
      "field": "beats_stats.metrics.beat.info.ephemeral_id",
      "inner_hits": {
        "name": "earliest",
        "size": 1,
        "sort": [
          {
            "beats_stats.timestamp": {
              "order": "asc",
              "unmapped_type": "long"
            }
          },
          {
            "@timestamp": {
              "order": "asc",
              "unmapped_type": "long"
            }
          }
        ]
      }
    },
    "sort": [
      {
        "beats_stats.beat.uuid": {
          "order": "asc",
          "unmapped_type": "long"
        }
      },
      {
        "timestamp": {
          "order": "desc",
          "unmapped_type": "long"
        }
      }
    ]
}