The Log Courier Suite is a set of lightweight tools created to ship and process log files speedily and securely, with low resource usage, to Elasticsearch or Logstash instances.
Other
419
stars
107
forks
source link
Logstash configuration auto reload is blocked by log-courier input #397
Logstash has a functionlaity to automatically reload configuration files when it sees some changes. This is nice, as logstash usually takes a long time to shut down and start up.
Unfortunately, this doesn't seem to work with log-courier. I am pretty sure it worked before, but not sure when it stopped, and if it was due to log-courier update, or logstash update.
Example of almost empty logstash configuration that works:
input {
}
filter {
date {
match => [ "timestamp", "MMM dd HH:mm:ss" ]
}
}
output{
}
After doing some whitespace change to the config, logstash shows:
[2023-02-07T09:59:19,092][INFO ][logstash.javapipeline ] Pipeline `main` is configured with `pipeline.ecs_compatibility: disabled` setting. All plugins in this pipeline will default to `ecs_compatibility => disabled` unless explicitly configured otherwise.
[2023-02-07T09:59:19,096][WARN ][org.logstash.execution.AbstractPipelineExt] Metric registration error: `input_throughput` could not be registered in namespace `[:stats, :pipelines, :main, :flow]`
[2023-02-07T09:59:19,096][WARN ][org.logstash.execution.AbstractPipelineExt] Metric registration error: `filter_throughput` could not be registered in namespace `[:stats, :pipelines, :main, :flow]`
[2023-02-07T09:59:19,096][WARN ][org.logstash.execution.AbstractPipelineExt] Metric registration error: `output_throughput` could not be registered in namespace `[:stats, :pipelines, :main, :flow]`
[2023-02-07T09:59:19,096][WARN ][org.logstash.execution.AbstractPipelineExt] Metric registration error: `queue_backpressure` could not be registered in namespace `[:stats, :pipelines, :main, :flow]`
[2023-02-07T09:59:19,096][WARN ][org.logstash.execution.AbstractPipelineExt] Metric registration error: `worker_concurrency` could not be registered in namespace `[:stats, :pipelines, :main, :flow]`
[2023-02-07T09:59:19,099][INFO ][logstash.javapipeline ][main] Starting pipeline {:pipeline_id=>"main", "pipeline.workers"=>24, "pipeline.batch.size"=>2000, "pipeline.batch.delay"=>50, "pipeline.max_inflight"=>48000, "pipeline.sources"=>["/home/logstash/conf.d/10-input.conf"], :thread=>"#<Thread:0x39031381 run>"}
[2023-02-07T09:59:19,100][WARN ][logstash.javapipeline ][main] CAUTION: Recommended inflight events max exceeded! Logstash will run with up to 48000 events in memory in your current configuration. If your message sizes are large this may cause instability with the default heap size. Please consider setting a non-standard heap size, changing the batch size (currently 2000), or changing the number of pipeline workers (currently 24) {:pipeline_id=>"main", :thread=>"#<Thread:0x39031381 run>"}
[2023-02-07T09:59:19,187][INFO ][logstash.javapipeline ][main] Pipeline Java execution initialization time {"seconds"=>0.09}
[2023-02-07T09:59:19,237][INFO ][logstash.javapipeline ][main] Pipeline started {"pipeline.id"=>"main"}
[2023-02-07T09:59:21,657][INFO ][logstash.javapipeline ][main] Pipeline terminated {"pipeline.id"=>"main"}
[2023-02-07T09:59:21,676][INFO ][logstash.agent ] Pipelines running {:count=>0, :running_pipelines=>[], :non_running_pipelines=>[:main]}
But if we change the config to include log-courier input:
Logstash has a functionlaity to automatically reload configuration files when it sees some changes. This is nice, as logstash usually takes a long time to shut down and start up. Unfortunately, this doesn't seem to work with log-courier. I am pretty sure it worked before, but not sure when it stopped, and if it was due to log-courier update, or logstash update.
Example of almost empty logstash configuration that works:
After doing some whitespace change to the config, logstash shows:
But if we change the config to include log-courier input:
And then do a whitespace change to the config file:
The log-courier port is blocked in firewall, so there's no real connections in this example test. I've tried to add a beat input like:
And beats does not make the reloading stuck (haven't tested with real clients connected to it).
Would it be possible to make it non-blocking?