Closed indrajithgihan closed 2 years ago
This is the thread that cause the high CPU load:
Thread #<Thread:0x00007fa274fa92e0@event_loop /usr/local/lib/ruby/gems/3.1.0/gems/fluentd-1.15.0/lib/fluent/plugin_helper/thread.rb:70 run> status=run priority=0
/usr/local/lib/ruby/gems/3.1.0/gems/fluentd-1.15.0/lib/fluent/plugin/parser_regexp.rb:50:in `match'
/usr/local/lib/ruby/gems/3.1.0/gems/fluentd-1.15.0/lib/fluent/plugin/parser_regexp.rb:50:in `parse'
/usr/local/lib/ruby/gems/3.1.0/gems/fluent-plugin-grok-parser-2.6.2/lib/fluent/plugin/parser_grok.rb:65:in `block in parse'
/usr/local/lib/ruby/gems/3.1.0/gems/fluent-plugin-grok-parser-2.6.2/lib/fluent/plugin/parser_grok.rb:64:in `each'
/usr/local/lib/ruby/gems/3.1.0/gems/fluent-plugin-grok-parser-2.6.2/lib/fluent/plugin/parser_grok.rb:64:in `parse'
/usr/local/lib/ruby/gems/3.1.0/gems/fluentd-1.15.0/lib/fluent/plugin/filter_parser.rb:73:in `filter_with_time'
/usr/local/lib/ruby/gems/3.1.0/gems/fluentd-1.15.0/lib/fluent/plugin/filter.rb:87:in `block in filter_stream'
/usr/local/lib/ruby/gems/3.1.0/gems/fluentd-1.15.0/lib/fluent/event.rb:196:in `block in each'
/usr/local/lib/ruby/gems/3.1.0/gems/fluentd-1.15.0/lib/fluent/event.rb:195:in `each'
/usr/local/lib/ruby/gems/3.1.0/gems/fluentd-1.15.0/lib/fluent/event.rb:195:in `each'
/usr/local/lib/ruby/gems/3.1.0/gems/fluentd-1.15.0/lib/fluent/plugin/filter.rb:85:in `filter_stream'
/usr/local/lib/ruby/gems/3.1.0/gems/fluentd-1.15.0/lib/fluent/event_router.rb:218:in `block in filter_stream'
/usr/local/lib/ruby/gems/3.1.0/gems/fluentd-1.15.0/lib/fluent/event_router.rb:217:in `each'
/usr/local/lib/ruby/gems/3.1.0/gems/fluentd-1.15.0/lib/fluent/event_router.rb:217:in `reduce'
/usr/local/lib/ruby/gems/3.1.0/gems/fluentd-1.15.0/lib/fluent/event_router.rb:217:in `filter_stream'
/usr/local/lib/ruby/gems/3.1.0/gems/fluentd-1.15.0/lib/fluent/event_router.rb:193:in `emit_events'
/usr/local/lib/ruby/gems/3.1.0/gems/fluentd-1.15.0/lib/fluent/event_router.rb:115:in `emit_stream'
/usr/local/lib/ruby/gems/3.1.0/gems/fluentd-1.15.0/lib/fluent/plugin/out_relabel.rb:29:in `process'
/usr/local/lib/ruby/gems/3.1.0/gems/fluentd-1.15.0/lib/fluent/plugin/output.rb:840:in `emit_sync'
/usr/local/lib/ruby/gems/3.1.0/gems/fluentd-1.15.0/lib/fluent/event_router.rb:196:in `emit_events'
/usr/local/lib/ruby/gems/3.1.0/gems/fluentd-1.15.0/lib/fluent/event_router.rb:115:in `emit_stream'
/usr/local/lib/ruby/gems/3.1.0/gems/fluentd-1.15.0/lib/fluent/plugin/in_tail.rb:619:in `receive_lines'
/usr/local/lib/ruby/gems/3.1.0/gems/fluentd-1.15.0/lib/fluent/plugin/in_tail.rb:1108:in `block in handle_notify'
/usr/local/lib/ruby/gems/3.1.0/gems/fluentd-1.15.0/lib/fluent/plugin/in_tail.rb:1144:in `with_io'
/usr/local/lib/ruby/gems/3.1.0/gems/fluentd-1.15.0/lib/fluent/plugin/in_tail.rb:1068:in `handle_notify'
/usr/local/lib/ruby/gems/3.1.0/gems/fluentd-1.15.0/lib/fluent/plugin/in_tail.rb:1010:in `block in on_notify'
/usr/local/lib/ruby/gems/3.1.0/gems/fluentd-1.15.0/lib/fluent/plugin/in_tail.rb:1010:in `synchronize'
/usr/local/lib/ruby/gems/3.1.0/gems/fluentd-1.15.0/lib/fluent/plugin/in_tail.rb:1010:in `on_notify'
/usr/local/lib/ruby/gems/3.1.0/gems/fluentd-1.15.0/lib/fluent/plugin/in_tail.rb:821:in `on_notify'
/usr/local/lib/ruby/gems/3.1.0/gems/fluentd-1.15.0/lib/fluent/plugin/in_tail.rb:399:in `block in setup_watcher'
/usr/local/lib/ruby/gems/3.1.0/gems/fluentd-1.15.0/lib/fluent/plugin/in_tail.rb:753:in `on_timer'
/usr/local/lib/ruby/gems/3.1.0/gems/cool.io-1.7.1/lib/cool.io/loop.rb:88:in `run_once'
/usr/local/lib/ruby/gems/3.1.0/gems/cool.io-1.7.1/lib/cool.io/loop.rb:88:in `run'
/usr/local/lib/ruby/gems/3.1.0/gems/fluentd-1.15.0/lib/fluent/plugin_helper/event_loop.rb:93:in `block in start'
/usr/local/lib/ruby/gems/3.1.0/gems/fluentd-1.15.0/lib/fluent/plugin_helper/thread.rb:78:in `block in thread_create'
Probably the cause is regexp in your config (probably it includes too wide condition to match against certain log), please check it:
pattern (?<message>[^\]]+ (?<timestamp>%{HOUR}:%{MINUTE}:%{SECOND}.%{NONNEGINT})\|\[(?<thread>[^\]]+)?\]\|%{IPORHOST:pod_instance}\|(?<severity>.*?)\|(?<log_type>.*?)\|(?<application>.*?)\|(?<microservice>.*?)\|(?<uuid>.*?)\|(?<message_type>.*?)\|(?<fullmessage>(.|\r|\n)*))
Describe the bug
Fluentd stucks with 100% cpu and not passing logs to elasticsearch. Found it is stuck in event_loop.
To Reproduce
Run a fluentd with attached configuration
Expected behavior
Fluentd should not stuck and pass logs to Elasticsearch
Your Environment
Your Configuration
Your Error Log
Additional context
No response