环境：ks2.1
最近看一个运行大半年的集群出现只采集默认组件空间的日志，不采集业务日志现象：
sh-4.2$ curl localhost:9200/_cluster/health?pretty
{
"cluster_name" : "elasticsearch",
"status" : "green",
"timed_out" : false,
"number_of_nodes" : 6,
"number_of_data_nodes" : 5,
"active_primary_shards" : 1114,
"active_shards" : 1665,
"relocating_shards" : 0,
"initializing_shards" : 0,
"unassigned_shards" : 0,
"delayed_unassigned_shards" : 0,
"number_of_pending_tasks" : 0,
"number_of_in_flight_fetch" : 0,
"task_max_waiting_in_queue_millis" : 0,
"active_shards_percent_as_number" : 100.0
}
看了下indices和shards都是正常状态，这个仅无法采集自定义的项目是和某种分组权限有关么
