# After Upgrade Logstash is running but not sending logs to elasticsearch

**URL:** https://discuss.elastic.co/t/after-upgrade-logstash-is-running-but-not-sending-logs-to-elasticsearch/294324
**Category:** Logstash
**Created:** [January 13, 2022, 7:40pm UTC](https://discuss.elastic.co/t/after-upgrade-logstash-is-running-but-not-sending-logs-to-elasticsearch/294324 "2022-01-13T19:40:03Z")
**Posts on this page:** 9
**Page:** 1

<div class="post-metadata">

### Author: ![Othmane\_CHHAIBI](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/othmane_chhaibi/32/99800_2.png) [@Othmane\_CHHAIBI](https://discuss.elastic.co/u/Othmane_CHHAIBI)
#### Post date: [January 13, 2022, 7:40pm UTC](https://discuss.elastic.co/t/after-upgrade-logstash-is-running-but-not-sending-logs-to-elasticsearch/294324/1 "2022-01-13T19:40:03Z")

</div>

hello everyone,  
After upgrading logstash from version 6.8 to 7.16.2, logstash is running but it didn't send logs to Elasticsearch. In the logfile of logstash server i have this error :

```auto
"[2022-01-03Tl3:50:23,910)[FATAL)[orq .loqstash .Loqstash J Loqstash stopped processing because ot an error : (SysternExit)exit"
"(2022-0l-03Tl3:50: 6, 96)(FATAL)(loo.std.sh.runner J An unexpected error occurred! (:error•>#<LooSta.5h::Error : Don't know how to handle 'Java ::OroLoostashSecretStore ::SecretStoreException::LoadException ·for 'Pipel1neAction: :Creat e ·> , :backt race•> ( ""oro/ loq.5ta5h /execu t ion/Convero-eRe.su ltEx t .j ava :135: in ·create 1 "", ""oro/ lOQ5ttl.5h /execu t1on/ConveroeRe5u ltEx t .java :60: in ·add'"", ""/usr I.share/ 100:1ta.sh / loo.sea.sh-core/ lib/ loc;i.sta.sh /ao-en t .rb: 396: 1n ·block 1n converoe_.stat eIti 1}"
"[2022-01-03Tl3:50:16,511](FATAL](orq.loqstash.Loqstash ]Logstash stopped proce.s.sing becau.se of an error: (SystemExit) exit"

```

please any suggestion to solve this issue ??  
regards.

 ![error_log](https://us1.discourse-cdn.com/elastic/original/3X/4/1/41c5f7c5c74ced84367760592ffac03cbcc521bf.png)

---

<div class="post-metadata">

### Author: ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [January 13, 2022, 7:48pm UTC](https://discuss.elastic.co/t/after-upgrade-logstash-is-running-but-not-sending-logs-to-elasticsearch/294324/2 "2022-01-13T19:48:45Z")

</div>

You need to share your full pipeline, maybe you are using a filter that does not exist anymore or was changed.

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [January 13, 2022, 11:12pm UTC](https://discuss.elastic.co/t/after-upgrade-logstash-is-running-but-not-sending-logs-to-elasticsearch/294324/3 "2022-01-13T23:12:08Z")

</div>

The exception is thrown by [this](https://github.com/elastic/logstash/blob/8fc4ea558549577475e8a695b03188f939a13ef3/logstash-core/src/main/java/org/logstash/secret/store/backend/JavaKeyStore.java#L266) method when it fails to load a Java keystore. It could be file access permissions, missing or incorrect password, or just that the file is not a JKS.

Note that if you upgraded to 7.16.2 then you are probably using a different JDK, since it is now bundled with logstash. I am uncertain if that could affect things, but you could set LS\_JAVA\_HOME to the old JDK and see if that changes the behaviour.

[This issue](https://github.com/elastic/logstash/issues/9711) has some additional comments.

---

<div class="post-metadata">

### Author: ![Othmane\_CHHAIBI](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/othmane_chhaibi/32/99800_2.png) [@Othmane\_CHHAIBI](https://discuss.elastic.co/u/Othmane_CHHAIBI)
#### Post date: [January 17, 2022, 10:23am UTC](https://discuss.elastic.co/t/after-upgrade-logstash-is-running-but-not-sending-logs-to-elasticsearch/294324/4 "2022-01-17T10:23:55Z")

</div>

how can i resolve that exactly (im using linux redhat 7) ? steps please ?

---

<div class="post-metadata">

### Author: ![Othmane\_CHHAIBI](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/othmane_chhaibi/32/99800_2.png) [@Othmane\_CHHAIBI](https://discuss.elastic.co/u/Othmane_CHHAIBI)
#### Post date: [January 17, 2022, 10:25am UTC](https://discuss.elastic.co/t/after-upgrade-logstash-is-running-but-not-sending-logs-to-elasticsearch/294324/5 "2022-01-17T10:25:35Z")

</div>

pipeline is the filters ? please what is exactly pipeline?

---

<div class="post-metadata">

### Author: ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [January 17, 2022, 1:04pm UTC](https://discuss.elastic.co/t/after-upgrade-logstash-is-running-but-not-sending-logs-to-elasticsearch/294324/6 "2022-01-17T13:04:55Z")

</div>

Pipeline is your entire configuration, your file with the input, filters and output.

---

<div class="post-metadata">

### Author: ![Othmane\_CHHAIBI](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/othmane_chhaibi/32/99800_2.png) [@Othmane\_CHHAIBI](https://discuss.elastic.co/u/Othmane_CHHAIBI)
#### Post date: [January 17, 2022, 4:17pm UTC](https://discuss.elastic.co/t/after-upgrade-logstash-is-running-but-not-sending-logs-to-elasticsearch/294324/7 "2022-01-17T16:17:58Z")

</div>

In directory **/etc/logstash/conf.d/** i have 3 input files :

000-input-syslog.conf :

```auto
input {
        udp {
        port => 1514
        type => syslog
      }
}

```

001-input-beat.conf :

```auto
input {
        beats {
        port => 5044
      }
}

```

70-kaspersky-input.conf

and i have 14 filters ; note that i don't use anymore 2 filters !

and one output to Elasticsearch :

```auto
output {
  if [indexName]{
  elasticsearch { hosts => ["172.19.19.9:9200"]
  index => "%{indexName}-%{+YYYY.MM.dd}"
  manage_template => false }
  }
  else{
  elasticsearch { hosts => ["172.19.19.9:9200"]
  index => "logstash-bulk-%{+YYYY.MM.dd}"
  manage_template => false }
  }
}

```

---

<div class="post-metadata">

### Author: ![Othmane\_CHHAIBI](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/othmane_chhaibi/32/99800_2.png) [@Othmane\_CHHAIBI](https://discuss.elastic.co/u/Othmane_CHHAIBI)
#### Post date: [January 17, 2022, 4:19pm UTC](https://discuss.elastic.co/t/after-upgrade-logstash-is-running-but-not-sending-logs-to-elasticsearch/294324/8 "2022-01-17T16:19:15Z")

</div>

the original error in the image above 👆

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 14, 2022, 4:20pm UTC](https://discuss.elastic.co/t/after-upgrade-logstash-is-running-but-not-sending-logs-to-elasticsearch/294324/9 "2022-02-14T16:20:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
