Tag Info

New answers tagged

0

As mentioned in another thread: "I had something similar, it sounds like you havent setup ACL's to allow the logstash user to view that log file. Use 'setfacl -m u:logstash-:r-x /var/log' for example, and then test by editing /etc/passwd and giving the logstash user a shell temporarily. Then, su - logstash, and try and cd or cat that file. If it works, ...


1

I had something similar, it sounds like you havent setup ACL's to allow the logstash user to view that log file. Use setfacl -m u:logstash:r-x /var/log for example, and then test by editing /etc/passwd and giving the logstash user a shell temporarily. Then, su - logstash, and try and cd or cat that file. If it works, then the data should appear in your ...


2

This has been answered pretty well on StackOverflow The full answer is worth reading but here are the key points: Moving and re-allocating shards is resource intensive. So having a server get added or removed on the fly can put a load on the system. You should already have 2 nodes for ElasticSearch already. It performs better that way and keeps the data ...


0

The case studies on elastic's site do have some numbers, for example from the data dog case study: At Stack Exchange we have found elastic scales very well (using for logstash, haproxylogs (~ 150 million log entries a day), and syslog/eventlog as well as the search for this site), but the first thing you need to do is quantify your load. With elastic it ...



Top 50 recent answers are included