Too many open threads causes other processes to crash

Elastic Stack Logstash
1

Hello,

We had an issue where logstash opened over 5000 threads. As a consequence, the OS didn't let other processes start on the machine and we had to kill the logstash process.

I'm guessing that logstash had one thread open per file. Most of the files are old and aren't getting updated, and since we are "tail'ing" them I'm guessing it makes no sense to have a thread watch over them.

Is there something we can do to optimize logstash to work with less threads?

Thanks

2

There's https://www.elastic.co/guide/en/logstash/5.1/plugins-inputs-file.html#plugins-inputs-file-max_open_files and https://www.elastic.co/guide/en/logstash/5.1/plugins-inputs-file.html#plugins-inputs-file-ignore_older

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.