CODEWITHSUNDEEP
elasticsearchlogstashkibanalogstash-forwarder
Ashwini Adlakha
Ashwini Adlakha

Reputation: 231

Why logstash-forwarder is not sending more than 100 events per lumberjack request?

I have seen that it is the flush_size that controls the events send per request in lumberjack(logstash-forwarder) but I have set it to 150 default as shown below

config :flush_size, :validate => :number, :default => 150

FILE: /opt/logstash/lib/logstash/outputs/elasticsearch_http.rb

but still I am not seeing lumberjack sending more than 100 events per request.

Jan 23 16:59:01 197nodnb13846 logstash-forwarder[30342]: 2015/01/23 16:59:01.496540 Connecting to [127.0.0.1]:5000 (127.0.0.1) 
Jan 23 16:59:01 197nodnb13846 logstash-forwarder[30342]: 2015/01/23 16:59:01.828968 Connected to 127.0.0.1
Jan 23 16:59:08 197nodnb13846 logstash-forwarder[30342]: 2015/01/23 16:59:08.146238 Registrar received 100 events
Jan 23 16:59:13 197nodnb13846 logstash-forwarder[30342]: 2015/01/23 16:59:13.500840 Registrar received 100 events
Jan 23 16:59:16 197nodnb13846 logstash-forwarder[30342]: 2015/01/23 16:59:16.938172 Registrar received 100 events
Jan 23 16:59:18 197nodnb13846 logstash-forwarder[30342]: 2015/01/23 16:59:18.330341 Registrar received 100 events
Jan 23 16:59:19 197nodnb13846 logstash-forwarder[30342]: 2015/01/23 16:59:19.347694 Registrar received 100 events
Jan 23 16:59:20 197nodnb13846 logstash-forwarder[30342]: 2015/01/23 16:59:20.341879 Registrar received 100 events
Jan 23 16:59:21 197nodnb13846 logstash-forwarder[30342]: 2015/01/23 16:59:21.339127 Registrar received 100 events
Jan 23 16:59:23 197nodnb13846 logstash-forwarder[30342]: 2015/01/23 16:59:23.060140 Registrar received 100 events
Jan 23 16:59:24 197nodnb13846 logstash-forwarder[30342]: 2015/01/23 16:59:24.680771 Registrar received 100 events
Jan 23 16:59:26 197nodnb13846 logstash-forwarder[30342]: 2015/01/23 16:59:26.196146 Registrar received 100 events
Jan 23 16:59:27 197nodnb13846 logstash-forwarder[30342]: 2015/01/23 16:59:27.043658 Registrar received 100 events
Jan 23 16:59:28 197nodnb13846 logstash-forwarder[30342]: 2015/01/23 16:59:28.203279 Registrar received 100 events

I have restarted logstash and logstash-forwarder after this but it is still not working.

Upvotes: 0

Views: 951

Answers (1)

Lfreitas
Lfreitas

Reputation: 11

Edit the init script and change the value of -spool-size:

grep DAEMON_ARGS /etc/init.d/logstash-forwarder

DAEMON_ARGS="-config /etc/logstash-forwarder -spool-size 100 -log-to-syslog"

/etc/init.d/logstash-forwarder restart

Upvotes: 1

Related Questions