elastic / elastic/logstash

Logstash pipeline gets stuck - TCP receive buffer full

Open
#8,159 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
14.9k
Forks
3.5k
Avg merge
19h 14m
Merged PRs (30d)
63

Description

After receiving and forwarding about 50 000 events, the lumberjack output connection gets "stuck". Nothing moves anymore, and in netstat it is visible that the send and receive queues are filled, and in particular the receive queue is full:

```
#netstat -ant
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 318924 52630 ::ffff:10.0.0.1:43014 ::ffff:10.1.1.1:1514 ESTABLISHED

```

Is this a known issue? How can this further be debugged?

- Version: logstash 5.5.2
- Operating System: CentOS 6.9
- Config File (if you have sensitive info, please remove it):

```
#Default syslog UDP
input {
udp {
type => "syslog"
port => 5514
}
}
output {
if ("forward" in [tags]) {
lumberjack {
hosts => "10.1.1.1"
port => 1514
ssl_certificate => "/etc/logstash/tls/cert.pem"
codec => plain {
format => '{"timestamp":"%{@timestamp}","source_type":"%{source_type}","origin_ip":"%{received_from_ipv4}","message":%{message}}'
}
}
}
}
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.