Logstash停止時にステータスがfailedになる

logstash停止時に、statusがfailedになる事象が発生しています。バージョンは7.8を使用しておりますが、100%の確率で発生します

# systemctl stop logstash
# systemctl status logstash
● logstash.service - logstash
   Loaded: loaded (/etc/systemd/system/logstash.service; disabled; vendor preset: disabled)
   Active: failed (Result: signal) since Thu 2020-07-16 17:23:57 JST; 11s ago
  Process: 3673 ExecStart=/usr/share/logstash/bin/logstash --path.settings /etc/logstash (code=killed, signal=KILL)
 Main PID: 3673 (code=killed, signal=KILL)

Jul 16 16:19:23 ip-10-0-22-157.ap-northeast-1.compute.internal logstash[3673]: [2020-07-16T16:19:23,161][INFO ][logstash.agent          ...
Jul 16 16:19:23 ip-10-0-22-157.ap-northeast-1.compute.internal logstash[3673]: [2020-07-16T16:19:23,631][INFO ][logstash.agent       ...00}
Jul 16 17:23:57 ip-10-0-22-157.ap-northeast-1.compute.internal systemd[1]: Stopping logstash...
Jul 16 17:23:57 ip-10-0-22-157.ap-northeast-1.compute.internal systemd[1]: logstash.service stop-sigterm timed out. Killing.
Jul 16 17:23:57 ip-10-0-22-157.ap-northeast-1.compute.internal systemd[1]: logstash.service still around after SIGKILL. Ignoring.
Jul 16 17:23:57 ip-10-0-22-157.ap-northeast-1.compute.internal systemd[1]: logstash.service stop-final-sigterm timed out. Killing.
Jul 16 17:23:57 ip-10-0-22-157.ap-northeast-1.compute.internal systemd[1]: logstash.service: main process exited, code=killed, statu...KILL
Jul 16 17:23:57 ip-10-0-22-157.ap-northeast-1.compute.internal systemd[1]: Stopped logstash.
Jul 16 17:23:57 ip-10-0-22-157.ap-northeast-1.compute.internal systemd[1]: Unit logstash.service entered failed state.
Jul 16 17:23:57 ip-10-0-22-157.ap-northeast-1.compute.internal systemd[1]: logstash.service failed.
Hint: Some lines were ellipsized, use -l to show in full

以下によると、logstashの停止処理に時間がかかる場合、強制的に停止してステータスがfailedになるケースはあるようですが、本事象のログを見ると、「Stopping logstash」と「 logstash.service stop-sigterm timed out. Killing」が同時刻に出ており、タイムアウトを待ち合わせていないように見えます。原因についてご教示頂けないでしょうか

https://www.elastic.co/guide/en/logstash/current/shutdown.html

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.