Logstash stops consuming input after journald-remote log rotation

[wraithm]

I have several journal-upload services sending logs to a central server running journald-remote, where I have logstash consuming the journald output. After the remote logs rotate, logstash stops consuming those remote logs. The sincedb cursor location halts at the end of the rotated file, so when logstash is restarted, it starts consuming the new logs. It would be great if I didn't have to restart logstash every time the remote logs rotate.

• Version: logstash 2.4.1, up to date logstash-input-journald
• Operating System: Ubuntu Xenial
• Config File:

input {
    # local logs
    journald {
        lowercase => true
        seekto => "head"
        thisboot => true
        type => "journald"
    }

    # remote logs
    journald {
        lowercase => true
        seekto => "head"
        thisboot => false
        type => "journald"
        sincedb_path => "/var/lib/logstash/.remote_sincedb_journal"
        path => "/var/log/journal/remote"
    }
}

• Steps to Reproduce:

1. Run journald-remote
2. Use journald input plugin to consume remote logs
3. Wait for journald-remote logs to rotate
4. Logstash stops consuming input

[mdunnio]

+1

[MeanderingCode]

I have what I believe is the same problem. I have not confirmed the timing of when the logs stop processing, however.

I have noticed that they will begin processing again after some time. I am not sure of the trigger for that, either.

Has anyone taken a look at this? Have either of you noticed that processing will resume after a window?

[octopusx]

+1

[vnadgir-ef]

+1

[vx3r]

+1