Logstash crashes everynight around same time . It goes OOM . It happens even with minimum load.
No errors noted in logstash.
ES status shows it went RED at exact same time
[2016-04-27 20:00:01,309][INFO ][cluster.metadata ] [vvofavlpd001.es1.data1] [orderingaccess-2016.04.28] creating index, cause [auto(bulk api)], templates [ordering_template], shards [1]/[1
], mappings [default, accesslog]
[2016-04-27 20:00:01,465][INFO ][cluster.routing.allocation] [vvofavlpd001.es1.data1] Cluster health status changed from [RED] to [YELLOW] (reason: [shards started [[orderingaccess-2016.04.28][0]]
...]).
[2016-04-27 20:00:01,572][INFO ][cluster.metadata ] [vvofavlpd001.es1.data1] [orderingaccess-2016.04.28] update_mapping [accesslog]
[2016-04-27 20:00:01,640][INFO ][cluster.routing.allocation] [vvofavlpd001.es1.data1] Cluster health status changed from [YELLOW] to [GREEN] (reason: [shards started [[orderingaccess-2016.04.28][0]
] ...]).
[2016-04-27 20:05:11,133][ERROR][license.plugin.core ] [vvofavlpd001.es1.data1]
Logstash ver: 2.2
ES Ver 2.2
Logstash Config
input {
file {
path => ["xxxxxxxxx/AccessLog.log"]
start_position => "beginning"
}
}
filter {
grok {
match => [ "message" , "%{DATA:ACTIVE_THREAD}|%{DATA:TIME}|%{DATA:ITW_ClientName}%{SPACE}|%{SPACE}%{DATA:XML_ClientName}%{SPACE}|%{SPACE}%{DATA:service_name}%{SPACE}|%{SPACE}%{DATA:method_n
ame}%{SPACE}|%{SPACE}%{DATA:code}%{SPACE}|%{SPACE}%{NUMBER:duration}" ]
remove_field => [ "thread" ]
}
if "_grokparsefailure" in [tags]
{
drop {}
}
}
output {
elasticsearch {
hosts => [ "xxxxxxxxxx:9203" ]
index => "orderingaccess-%{+YYYY.MM.dd}"
document_type => "accesslog"
manage_template => false
}
}