I am using elasticsearch 2.2.0, logstash 2.2.2, Kibana 4.4.1, topbeat 1.1.1 and filebeat 1.1.1 containers deployed Docker in a cluster of Mesos. When I deploy services everything seems to work fine, but after a few hours logstash stops send information to elasticsearch and this is the log file:
"Beats input: the pipeline is blocked, temporary refusing new connection.
message=>"Beats Input: Remote connection closed", :peer=>"172.29.6.20:35612", :exception=>#<Lumberjack::Beats::Connection::ConnectionClosed: Lumberjack::Beats::Connection::ConnectionClosed wrapping: lumberjack::Beats::Parser::UnsupportedProtocol, unsupported protocol 0>, :level=>:warn}
I saw also that this log file grows much as logstash works well. Some idea of the problem
This is my logstash.conf
input {
beats {
codec => json {
charset => "UTF-8"
}
port => {{logstash_container_port}}
}
}
filter {
grok {
match => { "source" => "/var/log/([^/]+)/logstasher_[^]+(?<build_id>[^]+)[^.]+.log" }
}
grok {
match => { "source" => "/var/log/(?<project_name>[^/]+)/[^.]+.log" }
}
}
output {
stdout {
codec => rubydebug
}
elasticsearch {
hosts => ["{{es_host}}:{{es_service_port}}"]
sniffing => true
manage_template => false
index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
document_type => "%{[@metadata][type]}"
}
}