What if log stash contained is stopped.

[imdmehdi]

Hi Team,

I am new to logstash.

Below configuration I added:
Serilog.ILogger CreateSerilogLogger(IConfiguration configuration)
{
var seqServerUrl = configuration["Serilog:SeqServerUrl"];
var logstashUrl = configuration["Serilog:LogstashgUrl"];
return new LoggerConfiguration()
.MinimumLevel.Verbose()
.Enrich.WithProperty("ApplicationContext", app.Environment.ApplicationName)
.Enrich.FromLogContext()
.WriteTo.Console()
.WriteTo.Seq(string.IsNullOrWhiteSpace(seqServerUrl) ? "http://seq" : seqServerUrl)
.WriteTo.Http(string.IsNullOrWhiteSpace(logstashUrl) ? "http://logstash:8080" : logstashUrl,null)
.ReadFrom.Configuration(configuration)
.CreateLogger();
}

logstash.conf:
input {
http {
#default host 0.0.0.0:8080
codec => json
}
}

Add your filters / logstash plugins configuration here

filter {
split {
field => "events"
target => "e"
remove_field => "events"
}
}

output {
elasticsearch {
hosts => "elasticsearch:9200"
index=>"webapisample-%{+xxxx.ww}"
}
}

Logstash docker file:

https://github.com/elastic/logstash-docker

FROM docker.elastic.co/logstash/logstash:7.9.2

Add your logstash plugins setup here

Example: RUN logstash-plugin install logstash-filter-json

RUN logstash-plugin install logstash-input-http

I was checking if my container goes down:
Scenario 1: If elastik container is down, once its up and running it shows all missed log during downtime.
Scenario 2: If I stop logstash container , then during downtime all logs are mised. When the logstash container is up then it tsarts picking live logs but logs of downtime still missing.

So, my query is how to handle missed logs in Scenario 2. Please help.

[FantasticFiasco]

The log events would only be missing if your process producing the log events crashed. One thing to note about Http and setting queueLimitBytes to null is that log events will be stored in memory in if the log server is unavailable. This will only work for as long as your hardware has memory to allocate, and when there is no more memory to allocate your process producing log events will crash and all events will be lost.

A better alternative is to use DurableHttpUsingFileSizeRolledBuffers or DurableHttpUsingTimeRolledBuffers because in those situations the log events are be stored on disk instead of in memory when the log server is unreachable.

Other than that, given that there's enough resources and that processes doesn't crash, the log events will finally end up on the log server.

[imdmehdi]

Thanks alot, it helped. Also one more query

If I use DurableHttpUsingFileSizeRolledBuffers, Is it better to give container volume path to write the buffer file? Or just default path will work fine? Does logs are deleted from buffer file once it's sent to elastic?