What is a recommended healthcheck to use for Logstash?

Elastic Stack Logstash
1

I'm in the process of upgrading from 1.4.2 to 1.5.2.

In 1.4.2, I ran Logstash with the 'web' option which I could then use in my ELB healthcheck.

<somepath>/logstash agent -f /etc/logstash.conf -l /<logdir>/logstash.log --verbose web -p <port>

This worked great, but it looks like the web option was removed from the agent in 1.5.0. Searching turns up some old posts about monitoring for consumption of messages (e.g. redis). We run pretty vanilla forwarder -> logstash and it works well for us (we're not too worried about losing a few messages).

Any simple suggestions?

Thanks,

K

2

Try the heartbeat plugin. I'm actually a bit surprised to hear that the web frontend was useful as a test.

3

Thanks for the response. This seems like it would be good for metrics/alerting, but not for an active healthcheck (needed by an ELB).

I'll probably change the ELB check to look for a listening port, but that's way less useful than having the application do something and return a status.

Cheers,

K

4

Why not have a tcp output plugin sending an "ok" from the heartbeat input plugin to your ELB? Then the ELB is in listen mode, rather than polling mode (provided that option is available—it works this way on F5s, IIRC).

input {
  heartbeat {
    interval => 10
    type => "heartbeat"
  }

output {
  if [type] == "heartbeat" {
    tcp {
      host => "elb.tld"
      port => 12345
      codec => plain
    }
  }
}
5

Interesting idea. Unfortunately, Amazon ELBs don't have a listen mode. They can only poll. As they're ephemeral (and typically multi-AZ for HA) there's no simple way to push to them 'I'm OK'.

Thanks for the thought.

K