Hello everybody,
I have a little configuration with logstash running as a service on a VPS sending logs to elasticsearch, and receiving informations from an external filebeat.
My elasticsearch configuration is not powerfull enough for the moment to handle all the logs comming from logstash, so I have a lot of
"message=>"Beats input: the pipeline is blocked, temporary refusing new connection.", :level=>:warn"
and messages of the same kind.
At one moment, i decided to change my logstash config (add a codec to get UTF-8) and restart my service.
I could stop the service but i've never been able to restart the service, logstash logging "Adress already in use -bind- [..]"
I tried to see what was wrong, but no process was using my port (netstats -nlp |grep port). If i tried to launch logstash manually with the command line, no problem, it was working correctly, only the service was blocked.
So i tried to change the port from beats input in my conf and restart the service, and TADA.
Now i have a logstash working correctly and listenning on BOTH ports..
I am thinking of the cache of logstash keeping the pipe on, but i'm a little lost about what is happenning here.