一段时间后，Logstash在ELK堆栈中停止接收？

Question

I have ELK stack (Elasticsearch/Logstash/Kibana) installed and running.

I use one server as ELK server to collect and store all logs from other servers. logstash-forwarder is used to send logs to ELK. The problem is:

Logstash is receiving alot of logs (as I checked with tailf logstash.stdout ) but after some period when I tailf logstash.stdout again, there are nothing (not receving logs), after restarting the Logstash daemon it begins to receive again.

Answer 1

when you use Logstash to filter data into files, when Logstash get EOF (end of file) occurs what you said.

If it's like I'm thinking, you can consulte this: How to return to terminal when logstash filter get eof?

In the case of using shippers, maybe works at same as files.

But if you describe better your problem/errors you can get more possible resolutions.