How to find the Reason and Event of a warning

Elastic Stack Logstash
1

Hello,

I got often this logstash warning.

[2024-07-30T13:39:05,486][WARN ][logstash.filters.throttle][main][34074a72c3b9ba7bd86762d4ae78ed3b6314e6bcc23a9a4cf6c5707484cc7c58] filters/LogStash::Filters::Throttle: timeslot disappeared, increase max_age to prevent this.

I try already to increase max_age time to minimum of the double of the duration time, without any effect.
My problem is, I don't know which "throttle" makes this warning and my logstash config has over 100 throttles.
It is possible to save/mark the event when it has a warning or an error?
Or do you have any other ideas to debug/solve this problem?

Thanks for your help
Thomas

2

Have you tried adding an id to each one of your throttle filters?

This is used to identifies the filter, when you do not add an id logstash generates one, if I'm not wrong is this hash here:

[2024-07-30T13:39:05,486][WARN ][logstash.filters.throttle][main][34074a72c3b9ba7bd86762d4ae78ed3b6314e6bcc23a9a4cf6c5707484cc7c58]

3

Not yet, I will try.

Thx.

I will give feedback in some days, it is helps.

4

I add erverywhere an ID and it works fine. Now I understood this feature. So cool. :slight_smile:

I found my throttle, which makes this problem.

Thank you.