Skip to content
Browse files
logstash: Reduce filter worker count to 1
When running with multiple worker threads the multiline filter
occasionally becomes confused and merges multiple events together. This
can result in events that cannot be serialized for output to
Elasticsearch. Once this happens no events will be added to
Elasticsearch until the logstash service is restarted.

Change-Id: Iac2e0980bfce66f546b352a5350614bdd482160c
  • Loading branch information
bd808 committed Jan 18, 2014
1 parent 080b6d6 commit 011aa76f0af62c3d5160c9f5e821108323cc3f16
Showing with 4 additions and 1 deletion.
  1. +4 −1 manifests/role/logstash.pp
@@ -36,7 +36,10 @@

class { '::logstash':
heap_memory_mb => 128,
filter_workers => 3,
# TODO: the multiline filter that is used in several places in the
# current configuration isn't thread safe and can cause crashes or
# garbled output when used with more than one thread worker.
filter_workers => 1,

class { '::logstash::input::udp2log':

0 comments on commit 011aa76

Please sign in to comment.