Date: Wed, 23 May 2018 16:23:36 +0100 From: Kernel Panic <kpnemesis@gmail.com> To: freebsd-ports@freebsd.org Subject: Logstash failing to process messages Message-ID: <CAHYqR4J4JuYs3ZCPz37jYifPoyT_NdLuNbfJxDMMx2=TTUWLQA@mail.gmail.com>
next in thread | raw e-mail | index | archive | help
Hello, I'll just list the versions before I start: FreeBSD 11.1 Logstash 6.23 Elasticsearch 5.6.8 Kibana 5.6.8 The issue I'm having is that after a few days Logstash will stop processing any messages; I'm using the same config file that I used with Logstash 5.3.0 which worked without issue and was rock-solid. There's nothing in the Logstash log file apart from messages about a field in my Cisco logs being the wrong type and therefore failing to index, however this has always been the case. I have tried enabling the 'dead letter' feature in Logstash to process these Cisco logs but that just makes Logstash even more unstable. The Logstash service doesn't actually crash, it just stops processing messages and fails to respond to the restart command so I end up having to reboot the server. I should say though that Logstash continues to respond the the monitor API commands. I have tried updating all Logstash plugins however that has not fixed the issue. As I said, I never had any problems with Logstash 5.3.0 but the latest version (and version 5.6.8) just seem to become unstable after a few days. Any help is greatly appreciated.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?CAHYqR4J4JuYs3ZCPz37jYifPoyT_NdLuNbfJxDMMx2=TTUWLQA>