Logstash hangs (CLOSE_WAIT)


Logstash version 7.3.2-1 on CentOS 7.6.1810

Since several days I noticed that Logstash is frozen every 24h.
When I check the server I found a lot of CLOSE_WAIT (131).

Nothing in the logstash-plain.log relevant and even no error logs displayed

tcp6 322 0 CLOSE_WAIT 0 0 -
tcp6 322 0 CLOSE_WAIT 0 0 -
tcp6 322 0 CLOSE_WAIT 0 0 -
tcp6 622 0 CLOSE_WAIT 0 0 -

My configuration is the following:
NGINX listening on port 443 (SSL) forwarding request to logstash on port 52001 (SSL) using http-input-plugin:

input {
http {
host => ""
port => 52001
ssl => true
ssl_certificate_authorities => ["/var/element/elk/certs/cert4.pem"]
ssl_certificate => "/var/element/elk/certs/fullchain4.pem"
ssl_key => "/var/element/elk/certs/privkey4.pem"
ssl_verify_mode => "peer"
tags => ["opt","lorawan"]

Any idea or clues to debug this?

The only things to do for the moment is to restart logstash


Any help?
The situation appears again today.
Is it possible to turn something in debug mode?


I found the root cause of my issue without for the moment found the solution but every 24 hours I got too many CLOSE_WAIT due to an input syslog plugin not used so I removed it for the moment.
If it can help someone :slight_smile:

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.