Logstash management info wrong?


(Pantelis Karamolegkos) #1

In our kibana UI the following is displayed when going to Management -> Logstash -> Pipelines

However, when tailing:

sudo tail -f /var/log/logstash/logstash-plain.log

[2018-06-06T15:46:44,686][INFO ][logstash.agent ] Pipelines running {:count=>8, :pipelines=>[".monitoring-logstash", "main", "p_mapping_channels", "p_mapping_fqdnvh", "p_mapping_hosts", "p_mapping_sldomain", "p_mapping_user_agents", "p_mapping_users"]}

And in practice we do see the pipelines running and producing the events.

Any idea why?


(Robert Cowart) #2

Did you configure Logstash to send X-Pack monitoring information to Elasticsearch?


(Pantelis Karamolegkos) #3

Αs long as I had 1 (main) pipeline, kibana UI indicated that there was 1 pipeline running;

as soon as I started using multiple pipelines, it started showing 0 pipelines as screenshoted above;


(Pantelis Karamolegkos) #4

Αnd here is the most weird part ...


(Pantelis Karamolegkos) #5

So when going

Management --> (Logstash)/Pipelines

I get

No Pipelines Found

(first screenshot)

When navigating via

Monitoring --> (Logstash)/Pipelines

I get the appropriate pipeline listing (second screenshot)

?


(Robert Cowart) #6

I missed the management part in your original post.

Those are two different things. Management -> Pipelines is for when you use Elasticsearch as a central repository for Logstash configs. You need X-Pack Gold for this. This has nothing to do with Monitoring.


(Pantelis Karamolegkos) #7

Thx.

So Management -> Pipelines will display the pipelines that were configured via elasticsearch ? (if I understand correctly the following sentence)

Management -> Pipelines is for when you use Elasticsearch as a central repository for Logstash configs


(Robert Cowart) #8

https://www.elastic.co/guide/en/logstash/current/logstash-centralized-pipeline-management.html


(system) #9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.