Logstash output input Logstash

Elastic Stack Logstash
1

Recently I started getting frequent Read timed out errors from Logstash 1 which is seding to another logstash via the plugin input/output Logstash.

I am experiencing a major latency issue. Data is not lost, but logs arrive in Elasticsearch with a very large delay (sometimes around 4 hours).

Has anyone experienced very large ingestion latency (hours) while data still eventually arrives?

2

Can you provide more context? What your pipelines looks like and what is your output?

To troubleshoot latency in Logstash you need to look at the full ingestion flow.

What is the input of your first logstash and what is the output of your last logstash?

Also, what are their versions? Are you using persistent queue?

If possible share the relevant pipeline configuration.

3

Thank you for your feedback.

I have resolved the latency issue but the error continues to appear in the logs.

I have configured PQ for both Logstash.

LS1 is listening on different ports, and all input and filter pipelines are sending to a single output pipeline, which forwards events to LS2 on port 9800.

I have tried a memory queue on LS1, but it doesnt resolve the issue.

I set the batch size on LS2 to 2000, but the error is still persistent.

4

You need to provide more context as asked in the previous post.

Without seeing the pipeline configuration to understand how it works it very complicated to help with any troubleshooting.

Also, share the log lines with the errors you are having.