Hi,
We are running logstash with 4 RabbitMQ input plugins, 1 file plugin and 1 elastcisearch output plugin in a single pipeline. During the network issue, all the buffered data during that period pushed into rabbitmq queues. Each message in queues is at least 50 kb of data. In that time, logstash and Java Runtime Environment stopped.
logstash.yml configuration is,
config.reload.automatic: true
config.reload.interval: 10s
queue.type: persisted
queue.max_events: 0
queue.max_bytes: 4gb
dead_letter_queue.enable: true
dead_letter_queue.max_bytes: 2gb
In jvm.options configuration heap size is,
-Xms10g
-Xmx15g
In logstash log this error shown,
#
# A fatal error has been detected by the Java Runtime Environment:
#
# EXCEPTION_ACCESS_VIOLATION (0xc0000005) at pc=0x00007ffa2a0b5047, pid=69420, tid=0x0000000000018390
#
# JRE version: Java(TM) SE Runtime Environment (8.0_181-b13) (build 1.8.0_181-b13)
# Java VM: Java HotSpot(TM) 64-Bit Server VM (25.181-b13 mixed mode windows-amd6
4 compressed oops)
# Problematic frame:
# C [KERNELBASE.dll+0x15047]
#
# Core dump written. Default location: C:\Software\logstash-6.2.3\bin\hs_err_pid694
20.mdmp
#
# An error report file with more information is saved as:
# C:\Software\logstash-6.2.3\bin\hs_err_pid69420.log
#
# If you would like to submit a bug report, please visit:
# Crash Report
# The crash happened outside the Java Virtual Machine in native code.
# See problematic frame for where to report the bug.
#
Environment:
Windows Server 2012 R2
java version "1.8.0_181"
Java(TM) SE Runtime Environment (build 1.8.0_181-b13)
Java HotSpot(TM) 64-Bit Server VM (build 25.181-b13, mixed mode)
Logstash 6.2.3
Elasticsearch 6.2.3
RabbitMQ 3.7