No need to cross fingers. You can confirm as soon as logstash is restarted with sniffing disabled.
lsof | grep "logstash.*TCP" | wc -l
Run it a few seconds apart (about 5s would do). If the number is not growing rapidly, you are golden.
1 Like