Dead Letter Queue - Cannot Write Event to DLQ

Elastic Stack Logstash
1

Hello , I have enabled DLQ on two different logstash instances running on AWS EC2 as docker container and everything was working fine almost 6+ months . Last week , my DLQ was filled up with 1GB messages and had to drop some fields to process it again . Got the below message on logs which was in line with the happenings at that time

[ERROR][org.logstash.common.io.DeadLetterQueueWriter] cannot write event to DLQ: reached maxQueueSize of 1073741824

The issue is , I still keep getting this message on the logs even after my DLQ was cleared ( right now its just 4KB ) and below is the logstash.yml that I am using

config.reload.automatic: true
path.data: /apps/logstash/data
queue.type: persisted
queue.page_capacity: 64mb
queue.max_bytes: 4gb
log.level: info
path.logs: /apps/logstash/log
dead_letter_queue.enable: true

I tried the below to resolve , yet no luck :

  1. Deleted the old logstash container and deployed a new container
  2. Cleared all the data from DLQ ( including .lock file _ and restarted the container

Any thoughts on this to fix the inconsistent log messages in logstash

2

Any thoughts on the above post ? Why Logstash saying reached max queue size reached on dlq though my actual size on DLQ is just 54MB .

Using logstash version 6.2.2

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.