Page 1 of 1
logstash not receiving logs
Posted: Fri Dec 19, 2014 4:37 am
by hlyeung
sometimes, we cannot receives log. after we restart logstash and elasticsearch, the log incomed immediately. thanks.
Re: logstash not receiving logs
Posted: Fri Dec 19, 2014 9:30 am
by scottwilkerson
What are the specs of your log server cluster instances?
CPU's
Memory
HD (SSD?)
How many logs per day are you sending?
Re: logstash not receiving logs
Posted: Tue Jan 06, 2015 1:46 am
by hlyeung
8 v-cpu: Intel(R) Xeon(R) CPU E5-2650 0 @ 2.00GHz
8G ram
HD: 100G, SATA
log per day: 4G so far
all 4 nodes running logstash and elasticsearch.
after i reboot nodes then it receives log again.
thanks for your help.
Re: logstash not receiving logs
Posted: Tue Jan 06, 2015 10:31 am
by scottwilkerson
This may be the Java VM running out of heap memory.
You can increase this by setting ES_HEAP_SIZE in /etc/sysconfig/elasticsearch. The general recommendation is to give it half of the available RAM. If you have 8GB total:
Code: Select all
ES_HEAP_SIZE=4g
MAX_LOCKED_MEMORY=unlimited
That last line keeps the ES heap from being swapped if possible (system limits may need to be adjusted to allow this).
Some more info on ES memory tuning:
http://www.elasticsearch.org/guide/en/e ... izing.html
Re: logstash not receiving logs
Posted: Thu Jan 08, 2015 4:00 pm
by nozlaf
I have the same issue, resorted to nightly reboots to work around the issue simple cron entry, may be a good feature if this was a configuration option from within NLS
Re: logstash not receiving logs
Posted: Thu Jan 08, 2015 4:33 pm
by sreinhardt
This really isn't something you should need to change very often. You are more than welcome to put in a feature request for it if that is something you want added.
Re: logstash not receiving logs
Posted: Tue Jan 20, 2015 2:32 am
by hlyeung
after i increased the memory for each nodes, now the problem seems gone. thanks.
Re: logstash not receiving logs
Posted: Tue Jan 20, 2015 10:55 am
by cmerchant
Glad you have a resolution. We'll go ahead and close this thread. Thanks.