Logstash 6.5.0 stops shipping logs to ES

Elastic Stack Logstash
21

The file input will track the "movement" of rotated content through file renames if the rotated filenames can be discovered, i.e. they are inside the glob pattern - it is more tested on *nix than Windows.

You can/should edit the glob to include the rotated patterns during the restart, perhaps.

22

@guyboertje, One other piece of information that I would like to add to the thread, but not sure if it will help. After 5 days of not receiving any logs we noticed that logs started appearing in ES again. We went and looked that the logstash logs on the server1 and server2 and we can see that server1 is processing the logs.

It seems to be that logstash was stuck somewhere processing the logs. Once again there is not much information in the logs.

Note: we did not restart logstash or restart the server. There seems to be something strange here.

I also want to point out that the output of the CPU percentage use by logstash looks very high:

process
open_file_descriptors 101
peak_open_file_descriptors 105
max_file_descriptors 4096
mem
total_virtual_in_bytes 4941590528
cpu
total_in_millis 1387457270
percent 100
load_average
1m 6.18
5m 6.44
15m 6.57
23

Anyone has more suggestions to provide here. Our logstash process CPU percent is at 100 and logstash stop processing events. Has anyone seen this behavior?

24

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.