Topbeat Logstash Elasticsearch seem to be working okay.
Started the configuration of Logstash syslog (rsyslog) input using the example file:
https://www.elastic.co/guide/en/logstash/current/config-examples.html#_processing_syslog_messages
Java memory error - only running elastic applications
logstash-syslog.conf
`
input {
beats {
port => 5044
}
tcp {
port => 5000
type => syslog
}
udp {
port => 5000
type => syslog
}
}
filter {
if [type] == "syslog" {
grok {
match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:[%{POSINT:syslog_pid}])?: %{GREEDYDATA:syslog_message}" }
add_field => [ "received_at", "%{@timestamp}" ]
add_field => [ "received_from", "%{host}" ]
}
date {
match => [ "syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss" ]
}
}
}
output {
elasticsearch {
hosts => "localhost:9200"
manage_template => false
index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
document_type => "%{[@metadata][type]}"
}
}
`
logstash -f logstash-syslog.conf
'
OpenJDK 64-Bit Server VM warning: INFO: os::commit_memory(0x00000000b5a00000, 357892096, 0) failed; error='Cannot allocate memory' (errno=12)
There is insufficient memory for the Java Runtime Environment to continue.
Native memory allocation (malloc) failed to allocate 357892096 bytes for committing reserved memory.
An error report file with more information is saved as:
/tmp/hs_err_pid36398.log
`
Glances
VIRT RES CPU% MEM% PID USER NI S TIME+ IOR/s IOW/s NAME
7.0G 685M 9.6 0.6 11886 logstash 19 S 15:35.35 0 0 java
9.7G 454M 0.0 0.4 26798 elasticse 0 S 59:00.69 0 0 java
/tmp/hs_err_pid36398.log
`
There is insufficient memory for the Java Runtime Environment to continue.
Native memory allocation (malloc) failed to allocate 357892096 bytes for committing reserved memory.
Possible reasons:
The system is out of physical RAM or swap space
In 32 bit mode, the process size limit was hit
Possible solutions:
Reduce memory load on the system
Increase physical memory or swap space
Check if swap backing store is full
Use 64 bit Java on a 64 bit OS
Decrease Java heap size (-Xmx/-Xms)
Decrease number of Java threads
Decrease Java thread stack sizes (-Xss)
Set larger code cache with -XX:ReservedCodeCacheSize=
This output file may be truncated or incomplete.
Out of Memory Error (os_linux.cpp:2827), pid=36398, tid=140689424713472
JRE version: (7.0_95) (build )
Java VM: OpenJDK 64-Bit Server VM (24.95-b01 mixed mode linux-amd64 compressed oops)
Derivative: IcedTea 2.6.4
Distribution: Ubuntu 14.04.3 LTS, package 7u95-2.6.4-0ubuntu0.14.04.1
Failed to write core dump. Core dumps have been disabled. To enable core dumping, try "ulimit -c unlimited" before starting Java again
--------------- T H R E A D ---------------
Current thread (0x00007ff4c8008800): JavaThread "Unknown thread" [_thread_in_vm, id=36412, stack(0x00007ff4cf0f0000,0x00007ff4cf2f1000)]
Stack: [0x00007ff4cf0f0000,0x00007ff4cf2f1000], sp=0x00007ff4cf2ef4e0, free space=2045k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
`
