For logstash it's 2GB of heap for elasticsearch i usually don't configure it, to let it determine the heap it needs dynamically at startup, but like I said I also tried various configurations from 1GB up to 16GB of heap for elasticsearch, always resulting in the same behaviour, but only for the pipeline with 8 different inputs at the first indexing with the huge data amounts, the other smaller pipelines are working perfectly fine.
I run it as a service with nssm on windows as explained in the tutorial.
I also checked the eventlog, but there is literally no information on the reason of the shutdown of the service at all. The only info is in the "system"-event log and its only the standard from the source "Service Control Manager" saying that "the elasticsearch service is now in the state "terminated"" (translated from the original german message), The Event-ID is 7036
That's the XML-Event Data for the event:
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
<EventID Qualifiers="16384">7036</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8080000000000000</Keywords>
<TimeCreated SystemTime="2022-09-19T11:20:07.0266984Z" />
<EventRecordID>151722</EventRecordID>
<Correlation />
<Execution ProcessID="916" ThreadID="4360" />
<Channel>System</Channel>
<Computer>NOT DISCLOSED</Computer>
<Security />
</System>
- <EventData>
<Data Name="param1">Elasticsearch 7.17.4 (elasticsearch-service-x64)</Data>
<Data Name="param2">Beendet</Data>
<Binary>65006C00610073007400690063007300650061007200630068002D0073006500720076006900630065002D007800360034002F0031000000</Binary>
</EventData>
</Event>