INFLIGHT_EVENTS_REPORT being logged every 5 seconds

Elastic Stack Logstash
1

I am seeing the following in my log every 5 seconds:

{:timestamp=>"2015-11-04T09:18:47.164000-0600", :message=>["INFLIGHT_EVENTS_REPORT", "2015-11-04T09:18:47-06:00", {"input_to_filter"=>0, "filter_to_output"=>0, "outputs"=>[]}], :level=>:warn}

What does this mean and how can I stop it?

It began after I did a restart on the logstash service.

2

Did you do a ps -ef | grep -i logstash to see if there are additional instances of logstash running?

1 Like
3

It means that logstash is still draining events that won't necessarily be persistent should you initiate another SIGTERM against the logstash instance... from what I gather it's telling you to "wait" for it to finish draining out it's buffer.

Personally my instance has been doing this for a good long while so I'm not sure when I'm supposed to assume it's done or if it's buffer is just ginormous.

@jbiggley, yes and no other instances are running

4

We see this periodically when the buffer empties. If your batch_size is set to an exceptionally high number, if you don't have enough worker processes assigned to the output, if you are groking the heck out of the data and haven't assigned enough grok workers... There are lots of reasons why this might take a while.

However, it should stop within due time. The other option is to hit ^C again or kill the running process.