How to clear logs and restart Logstash- 1 min
It’s pretty cool and has saved me from pulling my hair out grepping and tailing log files from a number of machines.
However, when ingesting data at very high rates Logstash sometimes fails and stops listening on port 5044. Doing a simple restart just results in Logstash trying to process the old logs that it is yet to index, which slows it down to a crawl yet again.
The procedure to clear out the logs from Logstash and start afresh strangely seems to not be specified in the documentation. Hence this post.
Logstash stores the logs it reads in the folder
/var/log/logstash (on Ubuntu 16.04) in the form of
logstash.stdout.* files in this location, and then restart logstash using
sudo systemctl restart logstash
sudo systemctl status logstash for good measure.