Logstash#
IRC: #logstash at freenode
Grok debugger: http://grokdebug.herokuapp.com/
Nginx config example: elasticsearch/kibana
Elasticsearch#
You may want to increase the maximum open file limit.
To show limits for a running process:
egrep 'files|Limit' /proc/$pid/limits
Increasing File Limits#
Global file handle limit (300k on a server, 800k on my desktop):
cat /proc/sys/fs/file-max
Upstart#
Add the following to your job:
limit nofile 64000 64000
Per User#
/etc/security/limits.conf:
elasticsearch hard nofile 64000
elasticsearch soft nofile 64000
And to make these settings apply for java in /etc/pam.d/common-session:
# nofile limit should apply for "java" executable too (elasticsearch)
session required pam_limits.so
Check what elasticsearch got:
curl localhost:9200/_nodes?process
http://stackoverflow.com/questions/34588/how-do-i-change-the-number-of-open-files-limit-in-linux Wildcard syntax seems not to work (http://elasticsearch-users.115913.n3.nabble.com/Too-many-open-files-exception-even-after-raising-the-open-file-limit-td2994940.html)