Logstash shutdown completed

Elastic Stack Logstash
1

Hello,
What it means that if I'm consuming from an index of ES (that has always incoming data) Logstash says : "Logstash shutdown completed"?.

My input config is this:

input {
elasticsearch {
hosts => "192.168.70.109:9200"
index => "itau-monitoreo*"
size => 500
scroll => "5m"
docinfo => "true"
}
}

Regards,

2

I don't think that input plugin is ever supposed to be shutting down ES. Do you have any other inputs that could trigger this? What else is in the log prior to the message in question?

3

I'm running 17 logstash conf files, each one reads from 1 different index. Some of them gets shut down and others don't.
Logstash startup completed Logstash shutdown completed
I'm using this command to run Logstash:

sudo -H -u logstash -c '/opt/logstash/bin/logstash -f /etc/logstash/conf.d/es-import-data[1-17].conf'

4

Take a look at https://www.elastic.co/guide/en/elasticsearch/reference/2.3/search-request-scroll.html

But when you use that it doesn't take into account new data, only data that exists in the index at the time you run LS (and it connects to ES).

5

And, how can I do a streaming index data extractor using LS?

6

You can't as we don't yet have a changes type API in ES.