Gracefully shutdown logstash

Elastic Stack Logstash
1

Hi,

How can i gracefully shutdown Logstash without losing any events that it might still be processing?

Basically what i want is to stop the input from processing and then wait until all events that are already under way to finish processing and only then terminate the process.

Is the the flow that happens today when i run service Logstash stop? And what about when Logstash receives a SIGTERM signal?

2

Is the the flow that happens today when i run service Logstash stop?

Yes, as of Logstash 1.5 that's how things work.

And what about when Logstash receives a SIGTERM signal?

service logstash stop sends SIGTERM.

3

Great to hear.

And is there a timeout that if Logstash doesn't finish by that timeout it will kill it? Or it just waits forever?

4

No such timeout is documented so I'd assume there is none.

https://www.elastic.co/guide/en/logstash/current/stalled-shutdown.html