Hi, simple question. Logstash produces a log-event when shutting down but not when starting up. Can I make it do that without activating the whol debug log?
Regards
It depends what you want to get, config.debug: true and journalctl --unit logstash might be useful. Check the documentation, log4j2 has own configuration.
Well, when its stopping it create one entry that its stopping. So when its starting, I want it just tell me it has started.
Maybe you could use metricbeat to monitor the process?
Yes, I could install another service to watch over that one starting and stopping. I Also can shoot me in the foot. I'm wondering about the consistency of Logstash. If it writs one line in its logs when it receives a shutdown signal, why not do the same when its starts? I thought when I use its logs to see if its working properly I could also see if it comes back up again after it stops for any reason. But when its not possible to have consistent logs from a tool made for logs, I'll use the windows process logs.
Ok, I can understand that. On the other hand the process Logstash does not exist yet when it receives a start request, so it cannot write anything to its logs about it.
Logstash does write a line that it is starting. And you could monitor the logstash logs for the line starting with [<timestamp>][INFO] [logstash.agent] Pipelines running {:count=>
Additional you could monitor the same line for the last bit, because it ends with :non_running_pipelines=>[]} if everything has started up fine, for as far as I know.
You could use Logstash to fetch and parse the Logstash logs, but that would not help you when Logstash crashes and does not start correctly.....