logstash crashed

[technosol]

Hi

I have two node NLS cluster. each node having 4 core CPU and 32 GB RAM.
Around 60 - 90 nodes sending syslogs continuously.

Suddenly, logstash was crashed and there was an error "Error: Your application used more memory than the safety cap of 500M"

However, I have not edited the default settings of the following logstash resources.

According to some technical guides, I have increased the following parameters.
https://support.nagios.com/kb/article/n ... g-576.html

vim /etc/sysconfig/logstash
LS_HEAP_SIZE="4g"

vim /etc/init.d/logstash
LS_HEAP_SIZE="2048m"
LS_OPEN_FILES=65535

May I know what are the suitable values to prevent this error and resolve the logstash crashing issue?

Thank you.

[scottwilkerson]

The setting in /etc/sysconfig/logstash will override the setting in /etc/init.d/logstash

With this setup I think setting the following in /etc/sysconfig/logstash should be more than enough, while leaving plenty of memory for elasticsearch to use

Code: Select all

LS_HEAP_SIZE="2048m"

[technosol]

Thank you,

I will monitor the process continuously and will update you the status in case if the logstash crashed again.

[scottwilkerson]

Thank you,

I will monitor the process continuously and will update you the status in case if the logstash crashed again.

Sounds good