Too many open threads causes other processes to crash

Hello,

We had an issue where logstash opened over 5000 threads. As a consequence, the OS didn't let other processes start on the machine and we had to kill the logstash process.

I'm guessing that logstash had one thread open per file. Most of the files are old and aren't getting updated, and since we are "tail'ing" them I'm guessing it makes no sense to have a thread watch over them.

Is there something we can do to optimize logstash to work with less threads?

Thanks

There's https://www.elastic.co/guide/en/logstash/5.1/plugins-inputs-file.html#plugins-inputs-file-max_open_files and https://www.elastic.co/guide/en/logstash/5.1/plugins-inputs-file.html#plugins-inputs-file-ignore_older

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.