Trouble sending GELF event - Graylog

Hello guys,

Could someone help me? I am having some issue when trying to push data to Graylog.

At the moment I am testing my environment, and everything is working properly.

Filebeat -> Logstash -> Graylog -> Elasticsearch

Here are my highlights:
When I turn my Logstash instance off and few minutes later on again, Filebeat resends the data and it works fine.

When I turn my Elasticsearch instance off and few minutes later on again, Logstash resends the data and it works fine.

The problem is when I turn my Graylog off. Then my Logstash starts receiving the error:
Trouble sending GELF event ........ (MY-MESSAGE-HERE)......... :error=>#<Errno::ECONNREFUSED: Connection refused - connect(2) for "localhost" port 5041>}

This is fine, I am expecting this error to happen, but Logstash is not trying to resend the data when I turn my Graylog on again.

Could someone help me?

My Logstash Persistent Queue is also activated with the config:

------------ Queuing Settings --------------

queue.type: persisted
queue.page_capacity: 64mb
queue.max_bytes: 1024mb
queue.checkpoint.writes: 1

Unfortunately, Logstash and Graylog will not work how I was expecting.

Logstash and Graylog can't issue an ACK sign.

The way I solved my problem was adding a RabbitMQ in the middle and configuring Logstash to send the logs to the RabbitMQ, in order to consume the messages with Graylog.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.