elasticsearch 8.6.2,Encountered an EOF error while configuring alert rules.
Author: kramerliCreated Sep 14, 2026Updated Sep 15, 2026
Question and Steps to reproduce
N9e 版本 v9.1.1 和 v8.4.1. Elasticsearch 版本 8.6.2.
重现步骤 (8.4.1 版本重现)
- 集成中心-数据源,新增 elasticsearch 数据源。
这里版本选的 7+。 因为8.4.1夜莺这里只有2个选项。6+或7+
- 告警-规则管理 新增告警规则。
在查询统计处,选择index pattern,输入 查询语句。
点 数据预览 报错如下图,返回 eof
其它信息:
- 网络连接没问题。因为我故意改错了数据源中 auth的配置。控制台可以正确报401错
- n9e 和 elasticsearch 中间没有代理。 2个进程在同一个机器上
- 我试过 n9e 的v9.1.1 。 也是同样错误。
- 查询语句在 kibana上能正常工作
Relevant logs and configurations
报错期间 n9e 8.4.1 版本日志
2026-09-14 12:27:59.732675 DEBUG dscache/sync.go:71 get datasource: {Id:1 Name:elastic-skywalking Identifier: Description: PluginId:0 PluginType:elasticsearch PluginTypeName: Category: ClusterName:default Settings:{"enable_write":true,"max_shard":5,"min_interval":10,"version":"7.0+"} SettingsJson:map[enable_write:true max_shard:5 min_interval:10 version:7.0+] Status:enabled HTTP:{"timeout":10000,"dial_timeout":0,"tls":{"skip_tls_verify":true},"max_idle_conns_per_host":0,"url":"","urls":["http://127.0.0.1:9200"],"headers":null} HTTPJson:{Timeout:10000 DialTimeout:10000 TLS:{SkipTlsVerify:true} MaxIdleConnsPerHost:100 Url: Urls:[http://127.0.0.1:9200] Headers:map[]} Auth:{"basic_auth":false,"basic_auth_user":"kibana_system","basic_auth_password":"xxx"} AuthJson:{BasicAuth:false BasicAuthUser:kibana_system BasicAuthPassword:xxx} CreatedAt:1789356944 UpdatedAt:1789359516 CreatedBy:root UpdatedBy:root IsDefault:false Transport:<nil> ForceSave:false}
2026-09-14 12:27:59.732767 DEBUG dscache/sync.go:194 get plugin by type success Ids:[1]
2026-09-14 12:28:00.128893 DEBUG eslike/eslike.go:542 query_data q:&{Ref:A IndexType:index_pattern Index:logs-* IndexPatternId:1 Filter:level: INFO Offset:0 MetricAggr:{Field: Func:count Ref:} GroupBy:[] DateField:@timestamp Interval:300 Start:1789359779 End:1789360079 P:0 Limit:0 Ascending:false Timeout:10 MaxShard:5 SearchAfter:<nil>} indexArr:[logs-*] tsAggr:&{field:@timestamp script:<nil> missing:<nil> subAggregations:map[] meta:map[] interval: fixedInterval:300s calendarInterval: order: orderAsc:false minDocCount:0xc000f1ef10 extendedBoundsMin:<nil> extendedBoundsMax:<nil> timeZone: format: offset:-300s keyed:<nil>} query_string:{"bool":{"filter":{"range":{"@timestamp":{"format":"epoch_millis","gte":1789359600000,"lte":1789359900000}}},"must":{"query_string":{"query":"level: INFO"}}}}
2026-09-14 12:28:00.130633 DEBUG eslike/eslike.go:564 query_data searchSource:{"aggregations":{"ts":{"date_histogram":{"field":"@timestamp","fixed_interval":"300s","min_doc_count":1,"offset":"-300s"}}},"query":{"bool":{"filter":{"range":{"@timestamp":{"format":"epoch_millis","gte":1789359600000,"lte":1789359900000}}},"must":{"query_string":{"query":"level: INFO"}}}}} resp:
2026-09-14 12:28:00.130654 WARNING router/router_query.go:132 query data error: req:map[end:1.789360079e+09 filter:level: INFO index_pattern:1 index_type:index_pattern interval:300 ref:A start:1.789359779e+09 value:map[func:count]] err:EOF
2026-09-14 12:28:00.720516 DEBUG memsto/host_alert_rule_targets.go:93 get_targets_of_alert_rule total: 0 engine_name:default
2026-09-14 12:28:01.733471 DEBUG dscache/sync.go:71 get datasource: {Id:1 Name:elastic-skywalking Identifier: Description: PluginId:0 PluginType:elasticsearch PluginTypeName: Category: ClusterName:default Settings:{"enable_write":true,"max_shard":5,"min_interval":10,"version":"7.0+"} SettingsJson:map[enable_write:true max_shard:5 min_interval:10 version:7.0+] Status:enabled HTTP:{"timeout":10000,"dial_timeout":0,"tls":{"skip_tls_verify":true},"max_idle_conns_per_host":0,"url":"","urls":["http://127.0.0.1:9200"],"headers":null} HTTPJson:{Timeout:10000 DialTimeout:10000 TLS:{SkipTlsVerify:true} MaxIdleConnsPerHost:100 Url: Urls:[http://127.0.0.1:9200] Headers:map[]} Auth:{"basic_auth":false,"basic_auth_user":"kibana_system","basic_auth_password":"xxx"} AuthJson:{BasicAuth:false BasicAuthUser:kibana_system BasicAuthPassword:xxx} CreatedAt:1789356944 UpdatedAt:1789359516 CreatedBy:root UpdatedBy:root IsDefault:false Transport:<nil> ForceSave:false}
2026-09-14 12:28:01.733566 DEBUG dscache/sync.go:194 get plugin by type success Ids:[1]除了 8.4.1版本 N9E 我还尝试了 9.1.1版本N9E。 遇到了同样的错误。下面是 9.1.1版本N9E 的日志
2026-09-14 13:25:03.783403 DEBUG logx/logx.go:89 trace_id=83d8647c-10c3-44d5-8736-637d6ad39b5c query_data q:&{Ref:A IndexType:index_pattern Index:logs-* IndexPatternId:1 Filter:level: DEBUG Offset:0 MetricAggr:{Field: Func:count Ref:} GroupBy:[] DateField:@timestamp Interval:600 Start:1789359903 End:1789363503 P:0 Limit:0 Ascending:false Timeout:100 MaxShard:5 SearchAfter:<nil>} indexArr:[logs-*] tsAggr:&{field:@timestamp script:<nil> missing:<nil> subAggregations:map[] meta:map[] interval: fixedInterval:600s calendarInterval: order: orderAsc:false minDocCount:0xc00968c8e0 extendedBoundsMin:<nil> extendedBoundsMax:<nil> timeZone: format: offset:-297s keyed:<nil>} query_string:{"bool":{"filter":{"range":{"@timestamp":{"format":"epoch_millis","gte":1789359903000,"lt":1789363503000}}},"must":{"query_string":{"query":"level: DEBUG"}}}}
2026-09-14 13:25:03.784750 INFO logx/logx.go:77 trace_id=83d8647c-10c3-44d5-8736-637d6ad39b5c query_data searchSource:{"aggregations":{"ts":{"date_histogram":{"field":"@timestamp","fixed_interval":"600s","min_doc_count":1,"offset":"-297s"}}},"query":{"bool":{"filter":{"range":{"@timestamp":{"format":"epoch_millis","gte":1789359903000,"lt":1789363503000}}},"must":{"query_string":{"query":"level: DEBUG"}}}}} resp:
2026-09-14 13:25:03.784768 WARNING logx/logx.go:85 trace_id=83d8647c-10c3-44d5-8736-637d6ad39b5c query data error: req:map[date_field:@timestamp end:1.789363503e+09 filter:level: DEBUG index_pattern:1 index_type:index_pattern interval:600 ref:A start:1.789359903e+09 value:map[func:count]] err:EOF
Version
n9e版本: v8.4.1 & v9.1.1
elasticsearch: 8.6.2
os: 版本
uname -a Linux skywalking-test001 6.8.0-124-generic #124-Ubuntu SMP PREEMPT_DYNAMIC Tue May 26 13:00:45 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux
Source: ccfos/nightingale