在安装loghide后，100%的CPU使用率-100%CPUusageafterlogstashinstall

21  

Digital Ocean's tutorial uses nginx in front of Kibana and listens on port 80. logstash ships with logstash-web that also wants to listen to port 80.

Digital Ocean的教程在Kibana前面使用nginx，并监听80端口。有logstash-web的船，也希望监听端口80。

Since Ubuntu uses upstart, trying to kill the java processes won't succeed as they will keep respawning according to /etc/init/logstash*.conf. The high CPU usage comes from the fact that logstash uses a lot of CPU time at startup and should calm down after a couple of seconds, but because it dies being unable to bind to port 80 and keeps respawning, it looks as if it's constantly using resources.

由于Ubuntu使用upstart，试图杀死java进程不会成功，因为它们将根据/etc/ init/loghide *.conf继续重生。高CPU使用率来自于loghide在启动时使用了大量CPU时间，并且应该在几秒钟后就会平静下来，但是因为无法绑定到端口80并继续重生，所以看起来它似乎一直在使用资源。

If you have the same problem as I did, look at logstash's PIDs and you will notice they change. You should also see Address already in use - bind - Address already in use at the end of /var/log/logstash/logstash.log.

如果你有和我一样的问题，看看loghide的pid，你会发现它们变了。您还应该看到已经在使用中的地址——绑定地址，在/var/ log/logstash/logstash/logstash.log的末尾已经使用了。

So, we just need to disable logstash-web. On Ubuntu, this can be done with:

所以，我们只需要禁用登录-web。在Ubuntu上，这可以通过:

$ echo manual | sudo tee /etc/init/logstash-web.override

$ echo manual | sudo tee /etc/init/logstash-web.override

To stop logstash-web without rebooting, we use

为了在不重新引导的情况下停止登录-web，我们使用

$ sudo stop logstash-web

$ sudo停止logstash-web

0  

You can kill the logstash processes using skill -u logstash. Run logstash in the foreground with increased verbosity.

您可以使用技能-u日志隐藏来终止日志隐藏进程。在前景中运行日志隐藏，增加冗余度。

If you change (temporarily) the output to be just a stdout output, what do you notice?

如果您将输出(暂时)更改为仅输出stdout，您会注意到什么?

Note that if you'll likely get communication with other nodes; saying host => localhost doesn't mean that you just get communication with port 9300 (I suggest testing with tcpdump on the lo and eth0 (or whatever is appropriate). So check your firewall, and perhaps take the firewall down temporarily.

注意，如果您可能与其他节点进行通信;说主机=> localhost并不意味着您只需要与端口9300进行通信(我建议在lo和eth0上使用tcpdump进行测试(或者任何合适的方法)。所以，检查你的防火墙，或者暂时关闭防火墙。

Also note that localhost may be giving you a IPv6 result; you may like to say 127.0.0.0 instead.

还要注意，localhost可能会给你一个IPv6结果;你可能喜欢说127.0.0.0。

The documentation the elasticsearch output can be seen at logstash docs

弹性搜索输出的文档可以在loghide文档中看到

You don't say if you're using the embedded elasticsearch or not; the default is false, so I guess you are not.

你不会说你是否在使用嵌入的弹性搜索;默认是假的，所以我猜你不是。

I do recall having an issue in my own deployment where logstash and elasticsearch were present on the same host, and there was a collision for port 9300; I resolved that by having logstash use port 9301 (bind_port).

我记得在我自己的部署中有一个问题，在同一个主机上有logstack和弹力搜索，9300端口发生了碰撞;我通过让loghide使用端口9301 (bind_port)解决了这个问题。

I suggest that you should also set the 'cluster'. The default 'protocol' will be 'node', which means it will try to become part of the cluster (not a data-node though), you could trying changing this to 'transport' or http and observe behavior change.

我建议您也应该设置“群集”。默认的“协议”将是“节点”，这意味着它将尝试成为集群的一部分(而不是数据节点)，您可以尝试将其更改为“传输”或http并观察行为更改。

I found it very useful to look at the network traffic carefully when I was starting out in order to carefully validate the behavior.

我发现，在开始时仔细查看网络流量非常有用，以便仔细验证该行为。

FWIW, I found the 'Logstash Book' very worthwhile (and cheap).

FWIW，我发现“日志收藏书”非常有价值(也很便宜)。