logstash
logstash copied to clipboard
Health Report Probe Docs: Up
As a part of the #16056 Health Report API, we will be introducing a per-pipeline probe called "pipeline/up" that is capable of diagnosing a pipeline based on its run-state.
Each diagnosis will need to provide a help_url
link to ${major}.${minor}
-specific documentation for that diagnosis. The following is meant to capture a high-level starting point for each of the probe's possible diagnoses.
running:
status: green
loading:
status: yellow
diagnosis:
cause: the pipeline is loading
action: wait for the pipeline to finish starting
help_url: "https://www.elastic.co/guide/en/logstash/${major}.${minor}/health_report/pipeline-up.html#loading"
help_text: >
Before a pipeline can consume and process events, its definition is loaded and compiled into an executable form.
Depending on the specific shape of the pipeline, it may also execute pre-flight checks to ensure that the events it consumes will have a safe path to their destination.
Pipelines typically remain in the "loading" state for only a few seconds at a time, so if your pipeline is taking significantly longer to load, you may need to dig into the pipeline's logs to determine if there is something wrong.
completed:
status: yellow
diagnosis:
cause: the pipeline has completed normally
action: if you expect the pipeline to run continuously, reconfigure configure its inputs and reload the pipeline
help_url: "https://www.elastic.co/guide/en/logstash/${major}.${minor}/health_report/pipeline-up.html#completed"
help_text: >
While many pipelines are designed to run indefinitely, some input plugins can be configured to run just once and will close themselves when their work is complete.
When _all_ of a pipeline's inputs have been closed, its workers finish processing events and exit.
A pipeline in this state has completed its work normally, has no more work to do, and is no longer running.
errored:
status: red
diagnosis:
cause: the pipeline has terminated due to an error
action: inspect logs to determine the cause of the pipeline crash; if reloading is enabled, change the pipeline's definition to trigger a reload.
help_url: "https://www.elastic.co/guide/en/logstash/${major}.${minor}/health_report/pipeline-up.html#errored"
help_text: >
The pipeline has crashed, and is no longer processing events.
This is an error condition that needs to be manually resolved.
Check the logs for to determine the cause of the crash.
If pipeline reloading is enabled, change the pipeline's definition to trigger a reload.
unknown:
status: unknown
diagnosis:
cause: the pipeline's run-state is unknown, likely because it was recently deleted.
action: if you expect the pipeline to be running, ensure that it still exists in the pipeline config source (e.g., `config/pipelines.yml`, Kibana Central Management)
help_url: "https://www.elastic.co/guide/en/logstash/${major}.${minor}/health_report/pipeline-up.html#unknown"
help_text: >
In logstash pipelines that rely on pipeline reloads, removing a pipeline from the config source causes it to be stopped and subsequently deleted.
There is a short window during the deletion of a pipeline that it can continue to show up in the health report API, event though its state can no longer be determined.