#logstash

crazyphil: thanks, dont appear to be any further issues *baffled*

it happens

could you have been running as a logstash user, then this time running as root?

oh, well yeah, I'm running cli as root

now started the service

boom

and its not listening again

2016-09-28T20:19:38-04:00 INFO Connecting error publishing events (retrying): dial tcp 192.168.15.8:5044: getsockopt: connection refused

thats from fb

any messages on the cli from logstash?

so there must be a resource limitation for the service user

I didnt run the cli as user

ok running cli as user

oh wait

you could be hitting a java memory cap

logstash will "just stop" when it runs out of memory

try increasing your java memory cap for logstash

you can find it in /etc/sysconfig/logstash

LS_HEAP_SIZE

I had that set at 31G

it still died

err sorry, thats es at 31g

what do yiou suggest I set LS_HEAP_SIZE to

ok --debug shows nothing.

for something thats supposed to work out of the box, this is too time consuming.

thanks anyway

so i've tested this again with chown of /opt/logstash and the log still shows the same error.

any input?

crazyphil: I *think* the issue was a called exec script that wasnt accessible as the logstash user

the last lines in the log referred to a script call that failed

and logstash stopped working. odd that though

100% java choke

I manually created script triggering events after fixing the script location issue and no more dying

still watching fb and ls in verbose and debug respectively

and the logstash-plugin list shows it to be installed.

ardya: I run my logstash heaps at 8GB

and have never looked back

I set mine to 1g, havent seen an issue yet