Logstash pipeline gets stuck - TCP receive buffer full
- Dominant language
- Java
- Stars
- 14.9k
- Forks
- 3.5k
- Avg merge
- 19h 14m
- Merged PRs (30d)
- 63
Description
After receiving and forwarding about 50 000 events, the lumberjack output connection gets "stuck". Nothing moves anymore, and in netstat it is visible that the send and receive queues are filled, and in particular the receive queue is full:
```
#netstat -ant
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 318924 52630 ::ffff:10.0.0.1:43014 ::ffff:10.1.1.1:1514 ESTABLISHED
```
Is this a known issue? How can this further be debugged?
- Version: logstash 5.5.2
- Operating System: CentOS 6.9
- Config File (if you have sensitive info, please remove it):
```
#Default syslog UDP
input {
udp {
type => "syslog"
port => 5514
}
}
output {
if ("forward" in [tags]) {
lumberjack {
hosts => "10.1.1.1"
port => 1514
ssl_certificate => "/etc/logstash/tls/cert.pem"
codec => plain {
format => '{"timestamp":"%{@timestamp}","source_type":"%{source_type}","origin_ip":"%{received_from_ipv4}","message":%{message}}'
}
}
}
}
```
Contributor guide
Assessment
This issue has not been assessed yet.