logstash not receiving logs

[hlyeung]

sometimes, we cannot receives log. after we restart logstash and elasticsearch, the log incomed immediately. thanks.

[scottwilkerson]

What are the specs of your log server cluster instances?
CPU's
Memory
HD (SSD?)

How many logs per day are you sending?

[hlyeung]

8 v-cpu: Intel(R) Xeon(R) CPU E5-2650 0 @ 2.00GHz
8G ram
HD: 100G, SATA
log per day: 4G so far
all 4 nodes running logstash and elasticsearch.

after i reboot nodes then it receives log again.
thanks for your help.

[scottwilkerson]

This may be the Java VM running out of heap memory.

You can increase this by setting ES_HEAP_SIZE in /etc/sysconfig/elasticsearch. The general recommendation is to give it half of the available RAM. If you have 8GB total:

Code: Select all

ES_HEAP_SIZE=4g
MAX_LOCKED_MEMORY=unlimited

That last line keeps the ES heap from being swapped if possible (system limits may need to be adjusted to allow this).

Some more info on ES memory tuning: http://www.elasticsearch.org/guide/en/e ... izing.html

[nozlaf]

I have the same issue, resorted to nightly reboots to work around the issue simple cron entry, may be a good feature if this was a configuration option from within NLS

[sreinhardt]

This really isn't something you should need to change very often. You are more than welcome to put in a feature request for it if that is something you want added.

[hlyeung]

after i increased the memory for each nodes, now the problem seems gone. thanks.

[cmerchant]

Glad you have a resolution. We'll go ahead and close this thread. Thanks.