Page 5 of 6
Re: logstash daemon stopping
Posted: Wed Jan 28, 2015 2:57 pm
by benhank
I did try the fixes last week and my partner redid them on monday. the logfile i sent was from this morning
Re: logstash daemon stopping
Posted: Wed Jan 28, 2015 3:09 pm
by scottwilkerson
Then you may be hitting a different limit.
Lets edit the following file, /etc/sysconfig/logstash
change this
to this
and restart logstash
Do this on all instances
Re: logstash daemon stopping
Posted: Wed Jan 28, 2015 4:06 pm
by benhank
done. here is a partial log file from /var/log/logstash/logstash.log
Re: logstash daemon stopping
Posted: Wed Jan 28, 2015 4:39 pm
by scottwilkerson
Ok, not it seems like there is more than one logstash process running... Ugh.
Lets do this
Code: Select all
service logstash stop
ps -ef|grep logstash
If you get ANY processes, you are going to have to kill them
Then,
Re: logstash daemon stopping
Posted: Thu Jan 29, 2015 11:39 am
by benhank
done Ill update you as time passes
Hey scott how does it work?
I have servers shooting logs to NLS. When the logstash daemon dies for whatever reason, are those logs still accumulating on the NLS server? t
How can I get the data that accumulated when the daemon was off? Is this even possible if there is only one instance running?
Re: logstash daemon stopping
Posted: Thu Jan 29, 2015 12:11 pm
by tmcdonald
Logstash is the first link in the chain. It is responsible for listening on the ports, taking in the logs, processing them, and then sending them off to Elasticsearch for storage and retrieval. If Logstash is not running then nothing will get into Elasticsearch.
Re: logstash daemon stopping
Posted: Thu Jan 29, 2015 3:31 pm
by benhank
thanks!
Re: logstash daemon stopping
Posted: Thu Jan 29, 2015 3:50 pm
by slansing
Awesome, how are things looking now?
Re: logstash daemon stopping
Posted: Thu Jan 29, 2015 5:25 pm
by benhank
I gotta wait till tomorrow
Re: logstash daemon stopping
Posted: Thu Jan 29, 2015 5:38 pm
by cmerchant
We'll await your reply. Thanks.