logstash daemon stopping

[benhank]

I did try the fixes last week and my partner redid them on monday. the logfile i sent was from this morning

[scottwilkerson]

Then you may be hitting a different limit.

Lets edit the following file, /etc/sysconfig/logstash
change this

Code: Select all

#LS_OPEN_FILES=2048

to this

Code: Select all

LS_OPEN_FILES=4096

and restart logstash

Code: Select all

service logstash restart

Do this on all instances

[benhank]

done. here is a partial log file from /var/log/logstash/logstash.log

[scottwilkerson]

Ok, not it seems like there is more than one logstash process running... Ugh.

Lets do this

Code: Select all

service logstash stop
ps -ef|grep logstash

If you get ANY processes, you are going to have to kill them

Then,

Code: Select all

service logstash start

[benhank]

done Ill update you as time passes

Hey scott how does it work?

I have servers shooting logs to NLS. When the logstash daemon dies for whatever reason, are those logs still accumulating on the NLS server? t
How can I get the data that accumulated when the daemon was off? Is this even possible if there is only one instance running?

[tmcdonald]

Logstash is the first link in the chain. It is responsible for listening on the ports, taking in the logs, processing them, and then sending them off to Elasticsearch for storage and retrieval. If Logstash is not running then nothing will get into Elasticsearch.

[benhank]

thanks!

[slansing]

Awesome, how are things looking now?

[benhank]

I gotta wait till tomorrow

[cmerchant]

We'll await your reply. Thanks.