I have an interesting one. I have a working v7.7 logstash config (on RHEL 7.x) which has suddenly stopped ingesting files. I am using the file input plugin in read mode to ingest single-use CSV files (each about 2 lines - a header and a data line).
I suspect this has to do with the recently increased number in the numbers being received. (from 6 digits to 8-9 digit numbers). This fixes itself for a bit for a short period and jams again.
I have looked into the usual places, without luck. Any suggestions on what I should be looking into?
No, the usual checks I have mentioned include file permission checks. Also, forgot to add that the logstash log files are oddly silent (other than the odd unrelated warning or two).
Right, so I tried trickle feeding the files in from batches as small as 10K, stepping up progressively in 1K, 5K and 10K batches. Oddly enough, I have started noticing some odd behaviour
Sometimes I need logstash to be restarted for the new files to be picked up
Oddly enough, accessing the <path.data>/plugins/inputs/file/.sincedb_* files with commands line wc -l seems to help - I have no idea why?!
The above steps stop working completely once the files cross 70K or so. Removing the processed files does not help. The only solution in this case is to remove the sincedb files. Obviously this is not a practical solution - only an effort intensive workaround
Also, back to the the PR mentioned previously. Specifically, the bin/logstash-plugin update logstash-input-file bit. Any ideas how I can do this in an offline mode? The Elastic does not have access to the internet. Is there an offline way to do this?
On the question of offline update to plugins, I spotted this in the docs. According to which, one can prepare and install offline packs for one/more plugin install as follows:
# prep an offline pack
bin/logstash-plugin prepare-offline-pack --output /path/to/logstash-input-file.zip --overwrite logstash-input-file
# install the offline pack on the target environment
bin/logstash-plugin install file:////path/to/logstash-input-file.zip
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.