Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[BUG] Memory leak in logstash-oss-with-opensearch-output-plugin 8.9 #259

Open
NamanChandra1 opened this issue Oct 1, 2024 · 1 comment
Labels
bug Something isn't working

Comments

@NamanChandra1
Copy link

NamanChandra1 commented Oct 1, 2024

Describe the bug
A clear and concise description of what the bug is.

To Reproduce
Steps to reproduce the behavior:

  1. Go to 'https://hub.docker.com/r/opensearchproject/logstash-oss-with-opensearch-output-plugin'
  2. docker pull opensearchproject/logstash-oss-with-opensearch-output-plugin:latest
  3. Configuration:
logstash.conf: |-
    input {
      kafka {
        consumer_threads => 5
        bootstrap_servers => "kafka:9092"
        decorate_events => basic
        group_id => "logstash"
        topics => ["kube-logs"]
        codec => "json"
      }
      http {
        port => 8000
        type => "healthcheck"
      }
    }
    filter {
      mutate {
        remove_field => ["[log][file][path]", "[log][offset]"]
      }

      if [kubernetes][labels][role] {
        mutate {
          add_field => { "kubernetes.annotations.role" => "%{[kubernetes][labels][role]}" }
        }
      }
      mutate {
        add_field => { "partition" => "%{[@metadata][kafka][partition]}" }
        remove_field => [ "host","event" ]
        add_field => { "index_label" => "%{[kubernetes][container][name]}"}
        add_field => { "kubernetes.pod_name" => "%{[kubernetes][pod][name]}"}
        add_field => { "kubernetes.container_name" => "%{[kubernetes][container][name]}"}
        add_field => { "kubernetes.pod_id" => "%{[kubernetes][pod][uid]}"}
        add_field => { "kubernetes.docker_id" => "%{[container][id]}" }
        add_field => { "kubernetes.namespace_name" => "%{[kubernetes][namespace]}"}
        add_field => { "kubernetes.container_image" => "%{[container][image][name]}"}
        add_field => { "kubernetes.host" => "%{[kubernetes][node][name]}"}
        }
      mutate {
        remove_field => ["[kubernetes][node][labels]", "[kubernetes][pod][uid]","[kubernetes][pod][name]","[agent]","[kubernetes][namespace_uid]",
        "[container][id]", "[kubernetes][replicaset]","[container][image][name]",
        "[kubernetes][namespace]" , "[kubernetes][namespace_labels]", "[kubernetes][container][name]",
        "[kubernetes][node]"]
      }
    }

    output {
      if "_jsonparsefailure" not in [tags] {
            opensearch {
                hosts => ["https://admin:[email protected]:9200"]
                index => "%{index_label}-new-%{+YYYY.MM.dd}"
                user => "admin"
                password => "admin"
                ssl => true
                ssl_certificate_verification => false
          }
      }  
    }
  logstash.yml: |
    http.host: 0.0.0.0
    pipeline.ecs_compatibility: disabled
    log.level: debug

Expected behavior
Push logs successfully to Opensearch with memory cleanup.

Screenshots
If applicable, add screenshots to help explain your problem.
image

Host/Environment (please complete the following information):

  • Running on Kubernetes
  • Version 1.30

Additional context
Add any other context about the problem here.

@NamanChandra1 NamanChandra1 added bug Something isn't working untriaged labels Oct 1, 2024
@dblock dblock removed the untriaged label Oct 2, 2024
@dblock
Copy link
Member

dblock commented Oct 2, 2024

May not be actually a leak, these processes may try to use all the memory they have. Does it eventually run out of memory in your case?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

2 participants