Logstash hangs (CLOSE_WAIT)

Hello,

Logstash version 7.3.2-1 on CentOS 7.6.1810

Since several days I noticed that Logstash is frozen every 24h.
When I check the server I found a lot of CLOSE_WAIT (131).

Nothing in the logstash-plain.log relevant and even no error logs displayed

...
tcp6 322 0 127.0.0.1:52001 127.0.0.1:33758 CLOSE_WAIT 0 0 -
tcp6 322 0 127.0.0.1:52001 127.0.0.1:42042 CLOSE_WAIT 0 0 -
tcp6 322 0 127.0.0.1:52001 127.0.0.1:41674 CLOSE_WAIT 0 0 -
tcp6 622 0 127.0.0.1:52001 127.0.0.1:35762 CLOSE_WAIT 0 0 -
...

My configuration is the following:
NGINX listening on port 443 (SSL) forwarding request to logstash on port 52001 (SSL) using http-input-plugin:

input {
http {
host => "0.0.0.0"
port => 52001
ssl => true
ssl_certificate_authorities => ["/var/element/elk/certs/cert4.pem"]
ssl_certificate => "/var/element/elk/certs/fullchain4.pem"
ssl_key => "/var/element/elk/certs/privkey4.pem"
ssl_verify_mode => "peer"
tags => ["opt","lorawan"]
}
}

Any idea or clues to debug this?

The only things to do for the moment is to restart logstash

Hello,

Any help?
The situation appears again today.
Is it possible to turn something in debug mode?

Br

I found the root cause of my issue without for the moment found the solution but every 24 hours I got too many CLOSE_WAIT due to an input syslog plugin not used so I removed it for the moment.
If it can help someone :slight_smile:

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.