Logstash not running in Remote Windows Continuously

I am using Logstash-7.17.4 version to index data from oracle db to Elasticsearch.
When I am running through Command Prompt, it is running but when running through Task Scheduler, logstash has stopped automatically after some time.

I have created 1 bat file and in that 2 commands are there::
cd D:\logstash-7.17.4-windows-x86_64\logstash-7.17.4\bin
logstash -f logstash-oracle.conf

I have run Logstash as a service in Task Scheduler.

My Logstash Configuration:
input {
jdbc {
clean_run => true
jdbc_driver_library => "D:\logstash-7.17.4-windows-x86_64\logstash-7.17.4\ojdbc8.jar"
jdbc_driver_class => "Java::oracle.jdbc.driver.OracleDriver"
jdbc_connection_string => "jdbc:oracle:thin:@Host:1521/service-name"
jdbc_user => "user"
jdbc_password => "user123"
schedule => "*/1 * * * * *"
statement => "SELECT * from emp"
use_column_value => true
tracking_column => "last_update_date"
tracking_column_type => "timestamp"
}
}
filter {
mutate {
remove_field => ["@version", "@timestamp"]
copy => { "id" => "esid" }
}
}

output {
elasticsearch{
hosts => ["https://domain1:9200","https://domain2:9200","https://domain3:9200"]
index => "testindex"
user => "user1"
password => "user1"
ssl => true
ssl_certificate_verification => true
cacert => 'D:\logstash-7.17.4-windows-x86_64\logstash-7.17.4\nonprodescertificate.cer'
document_id => "%{id}"
doc_as_upsert => true
}
stdout {
codec => rubydebug
}
}
could you @warkolm @sudhagar_ramesh @Badger please help me on this? This has to be deployed to PROD as well.

Use LS as a services with NSSM,it's easy to configure.

sure @Rios. Thanks for the update. I will check and update.

thank you so much @Rios for your help. I have used NSSM in remote windows to run Logstash as a Service. Now it is running and updating the logs as well.

In future please do not ping people that are not already part of your topic.

sure @warkolm

Hi Rios,

one clarification about NSSM.
If NSSM shuts down unexpectedly, then can we send an email alert?
Could you please help?
Thanks,
Suresh.

NSSM is only to register LS as the service on Windows and it's recommended to use by Elastic. Nothing more. You need Powershell script or extra application which will monitor Logstash log.
Check LS log, must be something inside. Set

log.level: debug

or TRACE. Also use some other log settings. Check : curl -XGET 'localhost:9600/_node/logging?pretty'

Since that is Windows host, check Event logs, App and System, should be something recorded there.
If you have a lot of events, might be your memory should be increased.

Thanks a lot for the update Rios. I will check and update.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.