Rebooting Logstash VM

Elastic Stack Logstash
1

Hello!

If I stop the Logstash service and reboot the the VM, will any incoming events during that time be lost?
Currently we have an Azure EventHub that sends the events to Logstash and then onwards to Elasticsearch.

I was not able to find any best practice information about restarting Logstash so any documentation would be very welcome!

Thanks in advance!

2

It depends on your inputs.

If you are using the azure eventhub input, then when Logstash will resume from the last offset it consumed before the restart.

3

Thank you for the information.

Would you say best practice is then to simply stop logstash.service, reboot the VM and start logstash.service again afterwards?

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.