[2.2.0] CLOSE_WAIT sockets/file descriptors multiplying until system crash

Elastic Stack Logstash
1

We are currently testing out Elasticsearch 2.2.0, Logstash 2.2.0, and Kibana 4.4.0 on Ubuntu 14.04

In the past few days we have begun to have an issue with too many file descriptors being opened with the Logstash process, specifically with TCP CLOSE_WAIT sockets . After a few minutes there are more than 600k CLOSE_WAIT showing with: sudo lsof | grep CLOSE_WAIT | wc -l

To give a little background on our setup. We have all nodes configured to send their logs to a single server running logstash which then connects to our ES cluster through an nginx proxy.

I just updated to the latest Java 8 but the issue is persisting.

Has anyone had similar issues in the past that can point me in the right direction?

2

Providing your config may help resolve this :slight_smile:

3

We think it had something to do with our use of an internal HAproxy on that node.