Auto restart Logstash on crash on ubuntu 12.04

Question

I have an elk cluster that is mostly very happy and well configured, but everyone now and then one of my users does something horrible to my logs (creates a single log line that is several gigs) and crashes logstash. If I manually restart logstash it will usually log an error for this line and move on to the next line.

I'm trying to set logstash to auto reboot after a crash. My installation is using an init.d file to configure the service. Reading through a bunch of ubuntu forums most people seem to recommend migrating the init.d to an upstart init config file rather than creating and playing configuring an inittab file.

Does anyone have experience / a recommendation on this? I'm running, logstash 2.1.3-1

Thanks

Answer 1

I encountered similar crashes on 14.04. Tried using a simple CRON to restart Logstash on a set scheduling rule but that didn't work out. We ended up using M/Monit to monitor a crash and restart the service.