Anyone know if all these error message will keep same in 5.x version?

Elastic Stack Logstash
#1

We using some key words to monitoring Logstash error:

  • "Beats input: The circuit breaker has detected a slowdown or stall in the pipeline"
  • "LogStash::Inputs::BeatsSupport::CircuitBreaker::HalfOpenBreaker"
  • "Beats input: the pipeline is blocked, temporary refusing new connection."
  • "LogStash::Inputs::Beats::InsertingToQueueTakeTooLong"

All these were used to be in old Logstash 2.x version and I believe in message fields

5.x seem changed a lot of logs format, will those message and/or key words still exist when same problem/error happen?

#2

We generally don't consider log messages to be part of any interface contract, so I don't think you can rely on such things.

Logstash 5.x has a monitoring api that you could perhaps use to ask questions of Logstash's behavior (are things stuck, what is the slowdown, what is the event rate, etc), and maybe this will help?

#3

Thanks, we will eventually start using monitoring API later this year. However, we would like to keep our existing monitoring system (which works well on 2.x version) before we implement new monitoring system based on API.

#4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.