# Catching/Logging Events That Break Parsing **URL:** \ **Category:** Logstash\ **Created:** [December 18, 2017, 10:12pm UTC](https://discuss.elastic.co/t/catching-logging-events-that-break-parsing/112320 "2017-12-18T22:12:21Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![cb2015](https://avatars.discourse-cdn.com/v4/letter/c/7993a0/32.png) [@cb2015](https://discuss.elastic.co/u/cb2015)\ **Post date:** [December 18, 2017, 10:12pm UTC](https://discuss.elastic.co/t/catching-logging-events-that-break-parsing/112320/1 "2017-12-18T22:12:21Z")
Hi Everyone, So I am using ELK to parse logs with the help of filebeat. I ran into an issue today where ~900 log lines were dropped when they should not have been. I know which lines these were. However, when I looked through the logstash, elasticsearch, and filebeat logs I could not find any mention of these dropped lines. So I am curious, does anyone write logstash configs in such a way that if an event is dropped, either the raw data is still indexed, or at least a document is created which would help in fixing the config? I've seen some of my SQL colleagues put "debugging" lines in their stored procs which write to a log say things like "sp\_example\_1 failed at step 8 of 12". Is there a logstash equivalent to this? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [December 19, 2017, 6:28am UTC](https://discuss.elastic.co/t/catching-logging-events-that-break-parsing/112320/2 "2017-12-19T06:28:43Z")
Have you looked into the dead letter queue feature? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 16, 2018, 6:28am UTC](https://discuss.elastic.co/t/catching-logging-events-that-break-parsing/112320/3 "2018-01-16T06:28:48Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.