Get health status

GET /_health_report

The health API returns a report with the health status of Logstash and the pipelines that are running inside of it. The report contains a list of indicators that compose Logstash functionality.

Each indicator has a health status of: green, unknown, yellow, or red. The indicator provides an explanation and metadata describing the reason for its current health status.

The top-level status is controlled by the worst indicator status.

In the event that an indicator status is non-green, a list of impacts may be present in the indicator result which detail the functionalities that are negatively affected by the health issue. Each impact carries with it a severity level, an area of the system that is affected, and a simple description of the impact on the system.

Some health indicators can determine the root cause of a health problem and prescribe a set of steps that can be performed in order to improve the health of the system. The root cause and remediation steps are encapsulated in a diagnosis. A diagnosis contains a cause detailing a root cause analysis, an action containing a brief description of the steps to take to fix the problem, and the URL for detailed troubleshooting help.

NOTE: The health indicators perform root cause analysis of non-green health statuses. This can be computationally expensive when called frequently.

Query parameters

  • pretty boolean

    If you append ?pretty=true to the request, the JSON returned will be pretty formatted. Use it for debugging only!

Responses

  • 200 application/json

    Indicates a successful call

    Hide response attributes Show response attributes object
    • host string

      The name of the host machine.

    • version string

      The version of the Logstash instance.

    • The HTTP address where the Logstash instance is accessible, including the port number.

    • id string

      A unique identifier (uuid) for the Logstash instance.

    • name string

      The name of the Logstash instance.

    • A unique identifier for the ephemeral session of the Logstash instance.

    • snapshot boolean | null
    • status string

      Health status of Logstash, based on the aggregated status of all indicators. Statuses are:

      • green: Logstash is healthy.
      • unknown: Logstash health could not be determined.
      • yellow: The functionality of Logstash is in a degraded state and may need remediation to avoid the health becoming red.
      • red: Logstash is experiencing an outage or certain features are unavailable for use.

      Values are green, red, unknown, or yellow.

    • symptom string
    • Information about the health of Logstash indicators.

      Hide indicators attribute Show indicators attribute object
      • Hide pipelines attributes Show pipelines attributes object
        • status string

          Health status of Logstash, based on the aggregated status of all indicators. Statuses are:

          • green: Logstash is healthy.
          • unknown: Logstash health could not be determined.
          • yellow: The functionality of Logstash is in a degraded state and may need remediation to avoid the health becoming red.
          • red: Logstash is experiencing an outage or certain features are unavailable for use.

          Values are green, red, unknown, or yellow.

        • symptom string
        • Hide indicators attribute Show indicators attribute object
          • * object Additional properties

            pipeline name

            Hide * attributes Show * attributes object
            • status string

              Health status of Logstash, based on the aggregated status of all indicators. Statuses are:

              • green: Logstash is healthy.
              • unknown: Logstash health could not be determined.
              • yellow: The functionality of Logstash is in a degraded state and may need remediation to avoid the health becoming red.
              • red: Logstash is experiencing an outage or certain features are unavailable for use.

              Values are green, red, unknown, or yellow.

            • symptom string

              A message providing information about the current health status.

            • details object

              An object that contains additional information about the indicator that has led to the current health status result.

              Hide details attributes Show details attributes object
            • impacts array[object]

              If a non-healthy status is returned, indicators may include a list of impacts that this health status will have on Logstash.

              Hide impacts attributes Show impacts attributes object
              • id string

                A unique identifier that may appear associated with a known impacts or issue. This ID follows a structured format that helps identify the specific problem.

              • severity integer

                How important this impact is to the functionality of Logstash. A value of 1 is the highest severity, with larger values indicating lower severity.

                Minimum value is 1, maximum value is 10.

              • A description of the impact on Logstash.

              • impact_areas array[string]

                The areas of Logstash affected by the health status. Possible values are:

            • diagnosis array[object]
              Hide diagnosis attributes Show diagnosis attributes object
              • id string

                A unique identifier that may appear associated with a known diagnosis or issue. This ID follows a structured format that helps identify the specific problem.

              • cause string

                A description of a root cause of this health problem.

              • action string

                A brief description of the steps that should be taken to remediate the problem. A more detailed step-by-step guide to remediate the problem is provided by the help_url field.

              • help_url string(uri)

                A link to the troubleshooting guide that will fix the health problem.

GET /_health_report
curl \
 --request GET 'http://api.example.com/_health_report' \
 --user "username:password"
The pipeline has finished without errors or interruptions.
{
  "symptom": "1 indicator is concerning (`pipelines`)",
  "indicators": {
    "pipelines": {
      "status": "yellow",
      "symptom": "1 indicator is concerning (`normal-completion-pipeline`)",
      "indicators": {
        "normal-completion-pipeline": {
          "status": "yellow",
          "details": {
            "status": {
              "state": "FINISHED"
            }
          },
          "impacts": [
            {
              "impact_areas": [
                "pipeline_execution"
              ]
            }
          ],
          "symptom": "The pipeline is concerning; 1 area is impacted and 1 diagnosis is available",
          "diagnosis": [
            {
              "cause": "pipeline has finished running because its inputs have been closed and events have been processed",
              "action": "if you expect this pipeline to run indefinitely, you will need to configure its inputs to continue receiving or fetching events"
            }
          ]
        }
      }
    }
  }
}
The pipeline is terminated with errors.
{
  "status": "red",
  "symptom": "1 indicator is unhealthy (`pipelines`)",
  "indicators": {
    "pipelines": {
      "status": "red",
      "symptom": "1 indicator is unhealthy (`abnormal-termination-pipeline`)",
      "indicators": {
        "abnormal-termination-pipeline": {
          "status": "red",
          "details": {
            "status": {
              "state": "TERMINATED"
            }
          },
          "impacts": [
            {
              "description": "the pipeline is not currently processing",
              "impact_areas": [
                "pipeline_execution"
              ]
            }
          ],
          "symptom": "The pipeline is unhealthy; 1 area is impacted and 1 diagnosis is available",
          "diagnosis": [
            {
              "cause": "pipeline is not running, likely because it has encountered an error",
              "action": "view logs to determine the cause of abnormal pipeline shutdown"
            }
          ]
        }
      }
    }
  }
}
A pipeline is blocked by slow downstream processing.
{
  "status": "red",
  "symptom": "1 indicator is unhealthy (`pipelines`)",
  "indicators": {
    "pipelines": {
      "status": "red",
      "symptom": "1 indicator is unhealthy (`blocked-pipeline`)",
      "indicators": {
        "blocked-pipeline": {
          "status": "red",
          "details": {
            "flow": {
              "worker_utilization": {
                "last_1_minute": 100.0,
                "last_5_minutes": 100.0
              }
            },
            "status": {
              "state": "RUNNING"
            }
          },
          "impacts": [
            {
              "id": "logstash:health:pipeline:flow:impact:blocked_processing",
              "severity": 1,
              "description": "the pipeline is blocked",
              "impact_areas": [
                "pipeline_execution"
              ]
            }
          ],
          "symptom": "The pipeline is unhealthy; 1 area is impacted and 1 diagnosis is available",
          "diagnosis": [
            {
              "id": "logstash:health:pipeline:flow:worker_utilization:diagnosis:5m-blocked",
              "cause": "pipeline workers have been completely blocked for at least five minutes",
              "action": "address bottleneck or add resources"
            }
          ]
        }
      }
    }
  }
}