How to restart logstash process inside docker ?
Right now I am restarting the container containing logstash but that does not look to be the ideal process to do it.
docker restart container-id
Which Docker image are you using? Depending on how the image has been set up the container might shut down when Logstash shuts down, i.e. there is no way to restart Logstash without affecting the container (and it's not clear why that would pose a problem for you).
1 Like
I am using recent 5.6.2 image on RHEL 7
docker.elastic.co/logstash/logstash 5.6.2 0a28dae3fd86 12 days ago 597.1 MB
We are planning to implement log-rotation polices using logrotate for which I need the command to start/stop logstash inside the container .
Creating startup script using the below command fails with the following error
/usr/share/logstash/bin/system-install /usr/share/logstash/config/startup.options
Using provided startup.options file: /usr/share/logstash/config/startup.options
Failed to get D-Bus connection: Operation not permitted
Successfully created system startup script for Logstash
I am using recent 5.6.2 image on RHEL 7
docker.elastic.co/logstash/logstash 5.6.2 0a28dae3fd86 12 days ago 597.1 MB
AFAICT that image sets the logstash binary as its entrypoint, so if that process dies then the container dies.
We are planning to implement log-rotation polices using logrotate for which I need the command to start/stop logstash inside the container .
Why would log rotation require you to restart Logstash without also restarting the container?
Creating startup script using the below command fails with the following error
/usr/share/logstash/bin/system-install /usr/share/logstash/config/startup.options
Are you running that inside the container? That won't work, for several reasons.
Thanks . That clarifies a lot .
Few further queries...
We redirected logstash log from console to file . The logs are now getting written to /usr/share/logstash/log/logstash.log which is inside the container. Now we want to to apply log-rotation on this file using logrotate for which I needed a restart of logstash process .
My rules will be like this
/usr/share/logstash/log/logstash.log {
daily
rotate 7
copytruncate
compress
delaycompress
missingok
notifempty
postrotate
logstash restart command here
endscript
}
If I am understanding correctly , you have suggested to restart container rather than restarting logstash. Not sure whether I will be able to achieve inside container .
Please suggest .
You'll want to make the log files available on the host (either via a direct host mount or a Docker volume) since you'll otherwise lose your logs when Logstash terminates. And if the files are available on the host, why run logrotate inside the container?
Another option could be to configure Logstash's logging (via log4j2.properties) to rotate the logs by itself. Then you won't have to bother with logrotate at all.
Thanks for clarifying . If I donot rotate the log file , this single file will continue to grow which will be a huge file after days of running .That's why was looking at logrotate option .. I will take a look at docker volume option to mount logs locally or may be log rotation using log4j as you suggested . BTW , I have defined the logrotate options and it seems to be working
cat /etc/logrotate.d/logstash
/usr/share/logstash/log/logstash.log {
daily
rotate 7
copytruncate
compress
delaycompress
missingok
notifempty
postrotate
kill -1 1
endscript
}
I am sending SIGHUP signal directly for reload of logstash after rotating the log.
ls -l /usr/share/logstash/log/
total 24
-rw-r--r-- 1 logstash logstash 0 Oct 10 08:26 logstash.log
-rw-r--r-- 1 logstash logstash 22679 Oct 10 08:26 logstash.log.1
Thanks for all the help in getting this resolved.
Thanks
Zaman
Aha, Logstash responds to SIGHUP. That's great.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.