Logs stopping and restarting logstash

[tim620]

Every few days all our systems stop sending logs (or so it appears). But, I can get the logs to start up again once I restart logstash (via "service logstash restart"). I assume I shouldn't need to continuously restart logstash. What are some possible causes and what logs on the OS or application can I look at to try and troubleshoot the issue?

[pbroste]

Hello @tim620

Thanks for reaching out, we see that the logstash.service is running under a init.d script wrapped in java. Here are several places to start looking:

Code: Select all

less /var/log/logstash.log

Code: Select all

less /var/log/messages or /var/log/syslog #depending on distro

Review the logs for errors, warnings, or other issues related to java and/or logstash.

Please let us know if you want us to either review the System Profile or any logs for issues by sending via private message.

Thanks,
Perry