Logstash: 5.3.0
Logstash is keeping TCP connections open even for servers that are shutdown. It also seems to be preventing the OS from closing the connections via TCP keep alive- I just have the default settings:
# cat /proc/sys/net/ipv4/tcp_keepalive_time
7200
# cat /proc/sys/net/ipv4/tcp_keepalive_intvl
75
# cat /proc/sys/net/ipv4/tcp_keepalive_probes
9
I also have duplicate tcp connections for the same hosts.
So I added `data_timeout => 500` to my input filter and restarted logstash but it looks like connections are still growing and remaining in the established state.
I think logstash is keeping the tcp connection active even if the server on the other end is shutdown? If the OS sees the connection as ESTABLISHED does that not count as an idle connection? Because in that case data_timeout would have no impact right?
I was hoping there would be a logstash setting for this, but it seems like logstash is even preventing the OS from cleaning up connections. I don't want to have to run a cronjob to restart logstash.
Edit: so it seems logstash doesn't implement TCP keep alives so my keep alive settings won't matter anyway and it will always leak TCP connections.
Should I open a bug report on github for this?