Kibana logstash not showing data after a period of time

Lee_Weng_Sheng · October 2, 2018, 10:02pm

Is there any troubleshoot steps?

[root@m logstash]# curl -XGET 'http://localhost:9200/_cat/indices?v'
docs.deleted store.size pri.store.size
0 472.6mb 472.6mb
0 160.3mb 160.3mb
0 164.3gb 164.3gb
0 171.4gb 171.4gb
0 164.6gb 164.6gb
53 261.5kb 261.5kb
0 153.8gb 153.8gb
0 165.4gb 165.4gb
0 230.9gb 230.9gb
0 172gb 172gb
0 162.7gb 162.7gb
0 133.1gb 133.1gb
0 165.9gb 165.9gb
0 323.2gb 323.2gb
0 164.7gb 164.7gb
0 148.8gb 148.8gb
0 186.3gb 186.3gb
0 162.6gb 162.6gb
0 339.9gb 339.9gb
0 164.9gb 164.9gb
0 162.9gb 162.9gb
0 165.9gb 165.9gb
0 214gb 214gb
0 339.7gb 339.7gb
0 154gb 154gb
0 150.4gb 150.4gb
0 331.1gb 331.1gb
0 321.7gb 321.7gb
0 240.5gb 240.5gb
0 165gb 165gb
0 1mb 1mb
0 151.3gb 151.3gb
0 189.5gb 189.5gb

Here's the latest log:
[2018-10-02T16:45:37,365][ERROR][logstash.shutdownwatcher ] The shutdown process appears to be stalled due to busy or blocked plugins. Check the logs for more information.
[2018-10-02T16:45:48,798][INFO ][logstash.modules.scaffold] Initializing module {:module_name=>"fb_apache", :directory=>"/usr/share/logstash/modules/fb_apache/configuration"}
[2018-10-02T16:45:48,802][INFO ][logstash.modules.scaffold] Initializing module {:module_name=>"netflow", :directory=>"/usr/share/logstash/modules/netflow/configuration"}
[2018-10-02T16:45:49,392][INFO ][logstash.outputs.elasticsearch] Elasticsearch pool URLs updated {:changes=>{:removed=>[], :added=>[http://127.0.0.1:9200/]}}
[2018-10-02T16:45:49,393][INFO ][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck_url=>http://127.0.0.1:9200/, :path=>"/"}
[2018-10-02T16:45:49,498][WARN ][logstash.outputs.elasticsearch] Restored connection to ES instance {:url=>"http://127.0.0.1:9200/"}
[2018-10-02T16:45:49,499][INFO ][logstash.outputs.elasticsearch] Using mapping template from {:path=>nil}
[2018-10-02T16:45:49,574][INFO ][logstash.outputs.elasticsearch] Attempting to install template {:manage_template=>{"template"=>"logstash-", "version"=>50001, "settings"=>{"index.refresh_interval"=>"5s"}, "mappings"=>{"default"=>{"_all"=>{"enabled"=>true, "norms"=>false}, "dynamic_templates"=>[{"message_field"=>{"path_match"=>"message", "match_mapping_type"=>"string", "mapping"=>{"type"=>"text", "norms"=>false}}}, {"string_fields"=>{"match"=>"", "match_mapping_type"=>"string", "mapping"=>{"type"=>"text", "norms"=>false, "fields"=>{"keyword"=>{"type"=>"keyword", "ignore_above"=>256}}}}}], "properties"=>{"@timestamp"=>{"type"=>"date", "include_in_all"=>false}, "@version"=>{"type"=>"keyword", "include_in_all"=>false}, "geoip"=>{"dynamic"=>true, "properties"=>{"ip"=>{"type"=>"ip"}, "location"=>{"type"=>"geo_point"}, "latitude"=>{"type"=>"half_float"}, "longitude"=>{"type"=>"half_float"}}}}}}}}
[2018-10-02T16:45:49,580][INFO ][logstash.outputs.elasticsearch] New Elasticsearch output {:class=>"LogStash::Outputs::ElasticSearch", :hosts=>["//127.0.0.1:9200"]}
[2018-10-02T16:45:49,620][INFO ][logstash.pipeline ] Starting pipeline {"id"=>"main", "pipeline.workers"=>40, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>5, "pipeline.max_inflight"=>5000}
[2018-10-02T16:45:49,674][INFO ][logstash.inputs.beats ] Beats inputs: Starting input listener {:address=>"127.0.0.1:5043"}
[2018-10-02T16:45:49,911][INFO ][logstash.pipeline ] Pipeline main started
[2018-10-02T16:45:49,920][INFO ][org.logstash.beats.Server] Starting server on port: 5043
[2018-10-02T16:45:49,936][INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port=>9600}

Is there other stuff i can check?

system · October 30, 2018, 10:02pm

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.