Ubuntu Server Elk Setup and test troubleshooting

Filebeat configuration file

[Email protected]:/etc/filebeat# cat filebeat.ymlfilebeat.prospectors:-type:log enabled:true paths:-/var/www/big Bear_server/shared/log/ms.log fields:log_tpics:server-type:log enabled:true paths:-/var/www/bigbear_sideki Q/shared/log/ms.log fields:log_tpics:sidekiq-type:log enables:true paths:-/application/nginx/logs/access81 0*.log fields:log_tpics:nginxoutput.logstash:hosts: ["x.x.x.x:5044"]

logstash configuration file

[email protected]:/application/logstash-6.2.4/bin# cat  /config/02-beats-input.confinput {    beats {#    host  =>  "x.x.x.x"     codec => plain{ charset =>  "UTF-8"  }    port => 5044#    ssl => true#     ssl_certificate =>  "/ETC/PKI/TLS/CERTS/LOGSTASH-FORWARDER.CRT" #     ssl_key =>  "/etc/pki/tls/private/logstash-forwarder.key"   }}output  {  elasticsearch {    codec => plain{ charset  =>  "UTF-8"  }    hosts =>  "http://localhost:9200" #     sniffing => true    manage_template => false     index =>  "%{[fields][log_topics]}--%{+yyyy. MM.DD} "    document_type => "%{[@metadata][type]} "  }}

View the number and description of open files for Logstash

[email protected]:/application/logstash-6.2.4/bin# curl -xget  ' localhost:9600/_node/stats/ Process?pretty ' {   "host"  :  "Product4",   "version"  :  "6.2.4",    "http_address"  :  "127.0.0.1:9600",   "id"  :  " 6E6FC083-B27E-4227-8DD4-DEC6BCC5FF4D ",  " name " : " Product4 ",  " process " :  {     "Open_file_descriptors"  : 146,     "Peak_open_file _descriptors " : 147,    " Max_file_descriptors " : 65536,      "mem"  : {       "Total_virtual_in_bytes"  :  14873796608    },     "CPU"  : {        "Total_in_millis"  : 134210,       "percent"  : 0,        "Load_average"  :  {         "1m"  : 0.79,          "5m"  : 0.77,         "15m"  : 0.48       }    }  }}

Note " open_file_descriptors "and" peak_open_file_descriptors "We see those over 1000 (when they are usually between 100 and 500). When the measure reaches four or five digits, the logstash is decreasing (or has fallen)

When the above counters are in 5-bit, "lsof-p logstashpid | Wc-l "command will still return a smaller number (less than 400).

For example, in the example above, Logstash has fallen by the time it reaches 10000. (Prob earlier)

But I don't know what to do from here.

This is obviously a logstash error, but no one has the elasticity to seem concerned.

Ubuntu Server Elk Setup and test troubleshooting