# Behavior of Logstash in case of crash in combination with syslog **URL:** \ **Category:** Logstash\ **Created:** [February 2, 2018, 10:39am UTC](https://discuss.elastic.co/t/behavior-of-logstash-in-case-of-crash-in-combination-with-syslog/118213 "2018-02-02T10:39:31Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![itspecialistsimon](https://avatars.discourse-cdn.com/v4/letter/i/838e76/32.png) [@itspecialistsimon](https://discuss.elastic.co/u/itspecialistsimon)\ **Post date:** [February 2, 2018, 10:39am UTC](https://discuss.elastic.co/t/behavior-of-logstash-in-case-of-crash-in-combination-with-syslog/118213/1 "2018-02-02T10:39:31Z")
Hi everyone, I'm quite new to ELK and want to know Logstash's behavior when it crashs. Assuming syslog is sending its data to Logstash and then Logstash suddenly crashs. What happens with the data syslog have already sent to Logstash? Does Logstash something like buffering? Or are the data lost? Thank you in advance. Best regards, Simon ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [February 2, 2018, 10:52am UTC](https://discuss.elastic.co/t/behavior-of-logstash-in-case-of-crash-in-combination-with-syslog/118213/2 "2018-02-02T10:52:38Z")
[https://www.elastic.co/guide/en/logstash/current/persistent-queues.html](https://www.elastic.co/guide/en/logstash/current/persistent-queues.html) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 2, 2018, 10:52am UTC](https://discuss.elastic.co/t/behavior-of-logstash-in-case-of-crash-in-combination-with-syslog/118213/3 "2018-03-02T10:52:38Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.