Logstash - java.lang.OutOfMemoryError: Java heap space

[Cyb3rWard0g]

Describe the problem
Logstash is set to calculate memory available and set its own LS_JAVA_OPTS by following this command: LS_MEMORY=$(awk '/MemAvailable/{printf "%.f", $2/1024/4}' /proc/meminfo). The problem with that is that the HELK Docker deployment builds all the containers in the same computer. Meanwhile other containers are being built, the memory consumption spikes utilizing a lot of the memory available for several seconds. Therefore, when Logstash checks for memory available, it might set it to 1M or 10M which is not enough. I get the following message when it tries to run:

java.lang.OutOfMemoryError: Java heap space

What steps did you take trying to fix the issue?
I created a while loop to create a condition and make Logstash wait until there is at least 950M of memory available for it.

# ********* Setting LS_JAVA_OPTS ***************
if [[ -z "$LS_JAVA_OPTS" ]]; then
  while true; do
    LS_MEMORY=$(awk '/MemAvailable/{printf "%.f", $2/1024/4}' /proc/meminfo)
    if [ $LS_MEMORY -gt 980 ]; then
      export LS_JAVA_OPTS="-Xms${LS_MEMORY}m -Xmx${LS_MEMORY}m"
      break
    else
      echo "[HELK-LOGSTASH-DOCKER-INSTALLATION-INFO] $LS_MEMORY MB is not enough memory for Logstash yet.."
      sleep 1
    fi
  done
fi
echo "[HELK-LOGSTASH-DOCKER-INSTALLATION-INFO] Setting LS_JAVA_OPTS to $LS_JAVA_OPTS"

How could we replicate the issue?
install Master 01312019

If you are having issue during the installation stage, please provide the HELK installation logs located at /var/log/helk-install.log

What version of HELK are you using?
Master 01312019

What OS are you using to host the HELK?
Ubuntu Xenial

Any additional context?
other log files, pictures, etc.

[AsimSattar96]

Hey @Cyb3rWard0g ,

I am still having this issue. I cloned the git repo today.

sudo docker logs helk-logstash

gives:

[HELK-LOGSTASH-DOCKER-INSTALLATION-INFO]  MB is not enough memory for Logstash yet..
[HELK-LOGSTASH-DOCKER-INSTALLATION-INFO]  MB is not enough memory for Logstash yet..
[HELK-LOGSTASH-DOCKER-INSTALLATION-INFO]  MB is not enough memory for Logstash yet..
[HELK-LOGSTASH-DOCKER-INSTALLATION-INFO]  MB is not enough memory for Logstash yet..
[HELK-LOGSTASH-DOCKER-INSTALLATION-INFO]  MB is not enough memory for Logstash yet..
[HELK-LOGSTASH-DOCKER-INSTALLATION-INFO]  MB is not enough memory for Logstash yet..
[HELK-LOGSTASH-DOCKER-INSTALLATION-INFO]  MB is not enough memory for Logstash yet..
[HELK-LOGSTASH-DOCKER-INSTALLATION-INFO]  MB is not enough memory for Logstash yet..
[HELK-LOGSTASH-DOCKER-INSTALLATION-INFO]  MB is not enough memory for Logstash yet..
[HELK-LOGSTASH-DOCKER-INSTALLATION-INFO]  MB is not enough memory for Logstash yet..
[HELK-LOGSTASH-DOCKER-INSTALLATION-INFO]  MB is not enough memory for Logstash yet..

And consequently, events are not shown on Kibana Interface. I would really appreciate any help in this manner.