Logstash-input-beats connections doesn't close properly - Am I doing something wrong?

Elastic Stack Logstash
1

Hello,

I have around 50 filebeats with this configuration:


output:
  logstash:
    hosts: ["******:10200"]
shipper:
logging:
  level: warning
  to_files: true
  to_syslog: false
  files:
    path: /var/log/filebeat
    name: filebeat.log
    rotateeverybytes: 1000000
    keepfiles: 5
filebeat:
  prospectors:
    - paths:
        - ******
      encoding: utf-8
      input_type: log
      fields:
        type: "***"
        component: "***"
      fields_under_root: true
      multiline:
        pattern: ^[0-9][0-9][0-9][0-9]-[0-9][0-9]
        negate: true
        match: after

And my logstash configuration:

input {
 beats {
    port => 10200
  }
}

output
{
  elasticsearch {
    hosts => ["localhost"]
  }

After a day or two the logstash service stops working since it has too many opened connection and I have to restart the service.
The output of netstat -p shows 16k lines of CLOSE_WAIT
After a search I saw in github a fix related to this issue in version 3.1.24 (and 5.0.1), both versions didn't seem to fix it for me.
It seems that the plugin still doesn't close the connections properly.
Or maybe I am doing something wrong?

My Logstash version is 5.6.1

Thank you for your help.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.