- Logstash Reference: other versions:
- Logstash Introduction
- Getting Started with Logstash
- How Logstash Works
- Setting Up and Running Logstash
- Logstash Directory Layout
- Logstash Configuration Files
- logstash.yml
- Secrets keystore for secure settings
- Running Logstash from the Command Line
- Running Logstash as a Service on Debian or RPM
- Running Logstash on Docker
- Configuring Logstash for Docker
- Running Logstash on Windows
- Logging
- Shutting Down Logstash
- Installing X-Pack
- Setting Up X-Pack
- Upgrading Logstash
- Configuring Logstash
- Structure of a Config File
- Accessing Event Data and Fields in the Configuration
- Using Environment Variables in the Configuration
- Logstash Configuration Examples
- Multiple Pipelines
- Pipeline-to-Pipeline Communication (Beta)
- Reloading the Config File
- Managing Multiline Events
- Glob Pattern Support
- Converting Ingest Node Pipelines
- Logstash-to-Logstash Communication
- Centralized Pipeline Management
- X-Pack monitoring
- X-Pack security
- X-Pack Settings
- Managing Logstash
- Working with Logstash Modules
- Working with Filebeat Modules
- Data Resiliency
- Transforming Data
- Deploying and Scaling Logstash
- Performance Tuning
- Monitoring Logstash
- Monitoring APIs
- Working with plugins
- Input plugins
- azure_event_hubs
- beats
- cloudwatch
- couchdb_changes
- dead_letter_queue
- elasticsearch
- exec
- file
- ganglia
- gelf
- generator
- github
- google_cloud_storage
- google_pubsub
- graphite
- heartbeat
- http
- http_poller
- imap
- irc
- jdbc
- jms
- jmx
- kafka
- kinesis
- log4j
- lumberjack
- meetup
- pipe
- puppet_facter
- rabbitmq
- redis
- relp
- rss
- s3
- salesforce
- snmp
- snmptrap
- sqlite
- sqs
- stdin
- stomp
- syslog
- tcp
- udp
- unix
- varnishlog
- websocket
- wmi
- xmpp
- Output plugins
- boundary
- circonus
- cloudwatch
- csv
- datadog
- datadog_metrics
- elastic_app_search
- elasticsearch
- exec
- file
- ganglia
- gelf
- google_bigquery
- google_pubsub
- graphite
- graphtastic
- http
- influxdb
- irc
- juggernaut
- kafka
- librato
- loggly
- lumberjack
- metriccatcher
- mongodb
- nagios
- nagios_nsca
- opentsdb
- pagerduty
- pipe
- rabbitmq
- redis
- redmine
- riak
- riemann
- s3
- sns
- solr_http
- sqs
- statsd
- stdout
- stomp
- syslog
- tcp
- timber
- udp
- webhdfs
- websocket
- xmpp
- zabbix
- Filter plugins
- aggregate
- alter
- cidr
- cipher
- clone
- csv
- date
- de_dot
- dissect
- dns
- drop
- elapsed
- elasticsearch
- environment
- extractnumbers
- fingerprint
- geoip
- grok
- http
- i18n
- jdbc_static
- jdbc_streaming
- json
- json_encode
- kv
- memcached
- metricize
- metrics
- mutate
- prune
- range
- ruby
- sleep
- split
- syslog_pri
- threats_classifier
- throttle
- tld
- translate
- truncate
- urldecode
- useragent
- uuid
- xml
- Codec plugins
- Tips and Best Practices
- Troubleshooting Common Problems
- Contributing to Logstash
- How to write a Logstash input plugin
- How to write a Logstash codec plugin
- How to write a Logstash filter plugin
- How to write a Logstash output plugin
- Documenting your plugin
- Contributing a Patch to a Logstash Plugin
- Logstash Plugins Community Maintainer Guide
- Submitting your plugin to RubyGems.org and the logstash-plugins repository
- Contributing a Java Plugin
- Glossary of Terms
- Breaking Changes
- Release Notes
- Logstash 6.8.23 Release Notes
- Logstash 6.8.22 Release Notes
- Logstash 6.8.21 Release Notes
- Logstash 6.8.20 Release Notes
- Logstash 6.8.19 Release Notes
- Logstash 6.8.18 Release Notes
- Logstash 6.8.17 Release Notes
- Logstash 6.8.16 Release Notes
- Logstash 6.8.15 Release Notes
- Logstash 6.8.14 Release Notes
- Logstash 6.8.13 Release Notes
- Logstash 6.8.12 Release Notes
- Logstash 6.8.11 Release Notes
- Logstash 6.8.10 Release Notes
- Logstash 6.8.9 Release Notes
- Logstash 6.8.8 Release Notes
- Logstash 6.8.7 Release Notes
- Logstash 6.8.6 Release Notes
- Logstash 6.8.5 Release Notes
- Logstash 6.8.4 Release Notes
- Logstash 6.8.3 Release Notes
- Logstash 6.8.2 Release Notes
- Logstash 6.8.1 Release Notes
- Logstash 6.8.0 Release Notes
- Logstash 6.7.2 Release Notes
- Logstash 6.7.1 Release Notes
- Logstash 6.7.0 Release Notes
- Logstash 6.6.2 Release Notes
- Logstash 6.6.1 Release Notes
- Logstash 6.6.0 Release Notes
- Logstash 6.5.4 Release Notes
- Logstash 6.5.3 Release Notes
- Logstash 6.5.2 Release Notes
- Logstash 6.5.1 Release Notes
- Logstash 6.5.0 Release Notes
- Logstash 6.4.3 Release Notes
- Logstash 6.4.2 Release Notes
- Logstash 6.4.1 Release Notes
- Logstash 6.4.0 Release Notes
- Logstash 6.3.2 Release Notes
- Logstash 6.3.1 Release Notes
- Logstash 6.3.0 Release Notes
- Logstash 6.2.4 Release Notes
- Logstash 6.2.3 Release Notes
- Logstash 6.2.2 Release Notes
- Logstash 6.2.1 Release Notes
- Logstash 6.2.0 Release Notes
- Logstash 6.1.3 Release Notes
- Logstash 6.1.2 Release Notes
- Logstash 6.1.1 Release Notes
- Logstash 6.1.0 Release Notes
Hot Threads API
editHot Threads API
editThe hot threads API gets the current hot threads for Logstash. A hot thread is a Java thread that has high CPU usage and executes for a longer than normal period of time.
curl -XGET 'localhost:9600/_node/hot_threads?pretty'
The output is a JSON document that contains a breakdown of the top hot threads for Logstash.
Example response:
{ "hot_threads" : { "time" : "2017-06-06T18:25:28-07:00", "busiest_threads" : 3, "threads" : [ { "name" : "Ruby-0-Thread-7", "percent_of_cpu_time" : 0.0, "state" : "timed_waiting", "path" : "/path/to/logstash-6.8.23/vendor/bundle/jruby/1.9/gems/puma-2.16.0-java/lib/puma/thread_pool.rb:187", "traces" : [ "java.lang.Object.wait(Native Method)", "org.jruby.RubyThread.sleep(RubyThread.java:1002)", "org.jruby.RubyKernel.sleep(RubyKernel.java:803)" ] }, { "name" : "[test2]>worker3", "percent_of_cpu_time" : 0.85, "state" : "waiting", "traces" : [ "sun.misc.Unsafe.park(Native Method)", "java.util.concurrent.locks.LockSupport.park(LockSupport.java:175)", "java.util.concurrent.locks.AbstractQueuedSynchronizer.parkAndCheckInterrupt(AbstractQueuedSynchronizer.java:836)" ] }, { "name" : "[test2]>worker2", "percent_of_cpu_time" : 0.85, "state" : "runnable", "traces" : [ "org.jruby.RubyClass.allocate(RubyClass.java:225)", "org.jruby.RubyClass.newInstance(RubyClass.java:856)", "org.jruby.RubyClass$INVOKER$i$newInstance.call(RubyClass$INVOKER$i$newInstance.gen)" ] } ] } }
The parameters allowed are:
|
The number of hot threads to return. The default is 10. |
|
If true, returns plain text instead of JSON format. The default is false. |
|
If true, does not return idle threads. The default is true. |
See Common Options for a list of options that can be applied to all Logstash monitoring APIs.
You can use the ?human
parameter to return the document in a human-readable format.
curl -XGET 'localhost:9600/_node/hot_threads?human=true'
Example of a human-readable response:
::: {} Hot threads at 2017-06-06T18:31:17-07:00, busiestThreads=3: ================================================================================ 0.0 % of cpu usage, state: timed_waiting, thread name: 'Ruby-0-Thread-7' /path/to/logstash-6.8.23/vendor/bundle/jruby/1.9/gems/puma-2.16.0-java/lib/puma/thread_pool.rb:187 java.lang.Object.wait(Native Method) org.jruby.RubyThread.sleep(RubyThread.java:1002) org.jruby.RubyKernel.sleep(RubyKernel.java:803) -------------------------------------------------------------------------------- 0.0 % of cpu usage, state: waiting, thread name: 'defaultEventExecutorGroup-5-4' sun.misc.Unsafe.park(Native Method) java.util.concurrent.locks.LockSupport.park(LockSupport.java:175) java.util.concurrent.locks.AbstractQueuedSynchronizer$ConditionObject.await(AbstractQueuedSynchronizer.java:2039) -------------------------------------------------------------------------------- 0.05 % of cpu usage, state: timed_waiting, thread name: '[test]-pipeline-manager' java.lang.Object.wait(Native Method) java.lang.Thread.join(Thread.java:1253) org.jruby.internal.runtime.NativeThread.join(NativeThread.java:75)