sbampa
January 8, 2018, 8:53am
1
Hi all,
i receive the following error in logstash logs and the process died.:
Error: unknown IOException: jnr.enxio.channels.NativeException: Error closing fd 371: Stale NFS file handle
Exception: Java::JavaLang::RuntimeException
Stack: org.jruby.util.io.PosixShim.close(PosixShim.java:260)
.....
.....
[2018-01-08T01:26:50,814][FATAL][logstash.runner ] An unexpected error occurred! {:error=>#<NoMethodError: undefined method map_cleanup' for nil:NilClass>, :backtrace=>["/export/home/elastic/logstash-6.0.0/vendor/bundle/jruby/2.3.0/gems/logstash-codec-multiline-3.0.7/lib/logstash/codecs/identity_map_codec.rb:55:in
block in start'"]}
I don't know the cause, can someone help me to solve?
guyboertje
(Guy Boertje)
January 8, 2018, 9:12am
2
The second FATAL error logged is a known rare case that is logged during shutdown.
The Stale NFS file handle
exception seems to be causing the LS shutdown.
What is your config? Where is NFS being used?
sbampa
January 8, 2018, 9:16am
3
LS in my config has 1 beats input and several file input, a grok filte with date and mutate and several output configs. 4 gb of heap, 16 worker (i have 16 cpu) and 250 pipeline.batch.size.
With file input i read from an nfs share....
guyboertje
(Guy Boertje)
January 8, 2018, 9:23am
4
There are known problems with the file input and NFS.
I had the same problem. Couldn't find a way around it. Our (dirty) hack/workaround is to have a scheduled task running every 5 minutes to:
shutdown logstash indexer
copy the file
restart logstash and index file
This is okay for us as we don't need perfectly real-time indexing at least it works reliably since a couple of months. It also solved the problems with locked resources we encountered before...
Missing event - file input plugin / NFS - #19 by steffens (with input from the LS and Beats teams)
You should put Filebeat on the machine that the NFS share points at.
system
(system)
Closed
February 5, 2018, 9:23am
5
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.