#logstash

ok, so I added an echo statement to the init script to print the $program and $args:

/opt/logstash/bin/logstash agent -f /etc/logstash/conf.d -l /var/log/logstash/logstash.log

when I start the logstash with "service logstash start" an index isn't even created. If I run the exact same command on the commandline everything starts working as expected.

does it say anything in the log file when you try to start it by the service logstash start?

All I get is "Sending logstash logs to /var/log/logstash/logstash.log" in logstash.stdout

that's the only content of any log file in /var/log/logstash/*

ok - some progress. I changed the user/group from logstash:logstash to root:root in the initscript and it seems to be working

probably not the best thing to do

of course, just troubleshooting

you shoudl prob fix the permission so you can run as logstash:logstash...runnig as root:root is dangerous

I think I figured it out... logstash can't read /var/log/apache2

for sure

just temporary during troubleshooting

problem is now you might have other permissions messed up

pid, etc.

/var/log/log../*.log as well

I think I have it working properly. I added logstash to the adm group and I also had to add the adm group to the chroot command in the initscript.

hi guyz

why logstash slower than statsd?

I used strace for analyze execution flow of logstash and found too much futex call

statsd can process more than 60k requests

but logstash only 10k

kalloc: LS does more

how to do it?

kalloc: do what?

more performance

more packet per second

kalloc: "do less" (though I just run multiple LS instances)

but I don't need run multiple instance of statsd

;0

kalloc: but statsd does less

it seems like either a) you seem unable to grasp the concept of "more work takes longer" or b) you're some sort of troll

I use only udp listener and udp output

I suspect b is easier to deal with

without filters

right, but there's still a bunch of LS transformation going on