Gracefully shutdown logstash

(Shahar Mor) #1

Hi,

How can i gracefully shutdown Logstash without losing any events that it might still be processing?

Basically what i want is to stop the input from processing and then wait until all events that are already under way to finish processing and only then terminate the process.

Is the the flow that happens today when i run service Logstash stop? And what about when Logstash receives a SIGTERM signal?

(Magnus Bäck) #2

Is the the flow that happens today when i run service Logstash stop?

Yes, as of Logstash 1.5 that's how things work.

And what about when Logstash receives a SIGTERM signal?

service logstash stop sends SIGTERM.

(Shahar Mor) #3

Great to hear.

And is there a timeout that if Logstash doesn't finish by that timeout it will kill it? Or it just waits forever?

(Magnus Bäck) #4

No such timeout is documented so I'd assume there is none.

https://www.elastic.co/guide/en/logstash/current/stalled-shutdown.html

(system) #5