Logstash 6.5.0 stops shipping logs to ES

(Guy Boertje) #21

The file input will track the "movement" of rotated content through file renames if the rotated filenames can be discovered, i.e. they are inside the glob pattern - it is more tested on *nix than Windows.

You can/should edit the glob to include the rotated patterns during the restart, perhaps.

(stash2logs) #22

@guyboertje, One other piece of information that I would like to add to the thread, but not sure if it will help. After 5 days of not receiving any logs we noticed that logs started appearing in ES again. We went and looked that the logstash logs on the server1 and server2 and we can see that server1 is processing the logs.

It seems to be that logstash was stuck somewhere processing the logs. Once again there is not much information in the logs.

Note: we did not restart logstash or restart the server. There seems to be something strange here.

I also want to point out that the output of the CPU percentage use by logstash looks very high:

open_file_descriptors 101
peak_open_file_descriptors 105
max_file_descriptors 4096
total_virtual_in_bytes 4941590528
total_in_millis 1387457270
percent 100
1m 6.18
5m 6.44
15m 6.57