# Elasticsearch gets unresponsive with logstash **URL:** \ **Category:** Elasticsearch\ **Created:** [December 26, 2014, 6:21am UTC](https://discuss.elastic.co/t/elasticsearch-gets-unresponsive-with-logstash/21393 "2014-12-26T06:21:54Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![chris85lang](https://avatars.discourse-cdn.com/v4/letter/c/a587f6/32.png) [@chris85lang](https://discuss.elastic.co/u/chris85lang)\ **Post date:** [December 26, 2014, 6:21am UTC](https://discuss.elastic.co/t/elasticsearch-gets-unresponsive-with-logstash/21393/1 "2014-12-26T06:21:54Z")
Hello, we use a two node elasticsearch (version 1.1.1) cluster in combination with logstash to centralize our log management. We currently facing the problem that the cluster gets unusable unresponsive after a couple of hours. The "head" plugin doesn't get any data as well as the Kibana web-interface. We cant see any errors in the logs and a curl Get respond 200 OK on both nodes. After restarting the elasticsearch service everything works fine again. On both nodes we have the following configuration: _grep ^[^#] /etc/elasticsearch/elasticsearch.yml_ _cluster.name: TEST\_Logstash_ _node.name: "server2"_ _path.data: /data/elasticsearch_ _discovery.zen.ping.multicast.enabled: false_ _discovery.zen.ping.unicast.hosts: ["server1:9300", "server2:9300"]_ _monitor.jvm.gc.young.warn: 500ms_ _monitor.jvm.gc.young.info: 200ms_ _monitor.jvm.gc.old.warn: 5s_ _monitor.jvm.gc.old.info: 2s_ _Cheers_ _Chris_ -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/4b2aa171-b2cc-4241-bd74-41cb50bb9009%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/4b2aa171-b2cc-4241-bd74-41cb50bb9009%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [December 26, 2014, 8:52pm UTC](https://discuss.elastic.co/t/elasticsearch-gets-unresponsive-with-logstash/21393/2 "2014-12-26T20:52:02Z")
Check your ES logs, you are probably running into GC issues. How many nodes, how much heap, how much data is on the nodes - both GB and index count, how many shards, how many replicas, what java version? On 26 December 2014 at 17:21, [chris85lang@googlemail.com](mailto:chris85lang@googlemail.com) wrote: > Hello, > > we use a two node elasticsearch (version 1.1.1) cluster in combination > with logstash to centralize our log management. > We currently facing the problem that the cluster gets unusable > unresponsive after a couple of hours. The "head" plugin doesn't get any > data as well as the Kibana web-interface. > We cant see any errors in the logs and a curl Get respond 200 OK on both > nodes. > > After restarting the elasticsearch service everything works fine again. > > On both nodes we have the following configuration: > _grep \[1\] /etc/elasticsearch/elasticsearch.yml_ > _cluster.name [http://cluster.name](http://cluster.name): TEST\_Logstash_ > _node.name [http://node.name](http://node.name): "server2"_ > _path.data: /data/elasticsearch_ > _discovery.zen.ping.multicast.enabled: false_ > _discovery.zen.ping.unicast.hosts: ["server1:9300", "server2:9300"]_ > _monitor.jvm.gc.young.warn: 500ms_ > _monitor.jvm.gc.young.info [http://monitor.jvm.gc.young.info](http://monitor.jvm.gc.young.info): 200ms_ > _monitor.jvm.gc.old.warn: 5s_ > _monitor.jvm.gc.old.info [http://monitor.jvm.gc.old.info](http://monitor.jvm.gc.old.info): 2s_ > > _Cheers_ > _Chris_ > > -- > You received this message because you are subscribed to the Google Groups > "elasticsearch" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > To view this discussion on the web visit > [https://groups.google.com/d/msgid/elasticsearch/4b2aa171-b2cc-4241-bd74-41cb50bb9009%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/4b2aa171-b2cc-4241-bd74-41cb50bb9009%40googlegroups.com) > [https://groups.google.com/d/msgid/elasticsearch/4b2aa171-b2cc-4241-bd74-41cb50bb9009%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/4b2aa171-b2cc-4241-bd74-41cb50bb9009%40googlegroups.com?utm_medium=email&utm_source=footer) > . > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CAEYi1X-2w5sD0u4F1463%2BpD8ZB\_O0kKWFdA3MP65F9mGnAURTA%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAEYi1X-2w5sD0u4F1463%2BpD8ZB_O0kKWFdA3MP65F9mGnAURTA%40mail.gmail.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). * * * 1. ^# ---
**Author:** ![chris85lang](https://avatars.discourse-cdn.com/v4/letter/c/a587f6/32.png) [@chris85lang](https://discuss.elastic.co/u/chris85lang)\ **Post date:** [December 29, 2014, 4:07am UTC](https://discuss.elastic.co/t/elasticsearch-gets-unresponsive-with-logstash/21393/3 "2014-12-29T04:07:58Z")
Hello, sorry for the incomplete information I'm kinda new to elasticsearch. - In our setup we have 2x elasticsearch data/client nodes and 4 logstash instances just seen as clients. - both elsaticsearch servers have 32 GB memory and the heap is 8GB -Xms8g -Xmx8g -Xss256k - 150 total shards - 15 Indices - 40,100,997 documents - 21 GB total size - Java(TM) SE Runtime Environment (build 1.7.0\_67-b01) - One replica For each day a new index is created with 5 shards an one replica. I hope this helps, thank you! Cheers Chris On Saturday, December 27, 2014 3:52:30 AM UTC+7, Mark Walkom wrote: > Check your ES logs, you are probably running into GC issues. > > How many nodes, how much heap, how much data is on the nodes - both GB and > index count, how many shards, how many replicas, what java version? > > On 26 December 2014 at 17:21, \<[chris...@googlemail.com](mailto:chris...@googlemail.com) \\> > wrote: > > > Hello, > > > > we use a two node elasticsearch (version 1.1.1) cluster in combination > > with logstash to centralize our log management. > > We currently facing the problem that the cluster gets unusable > > unresponsive after a couple of hours. The "head" plugin doesn't get any > > data as well as the Kibana web-interface. > > We cant see any errors in the logs and a curl Get respond 200 OK on both > > nodes. > > > > After restarting the elasticsearch service everything works fine again. > > > > On both nodes we have the following configuration: > > _grep \[1\] /etc/elasticsearch/elasticsearch.yml_ > > _cluster.name [http://cluster.name](http://cluster.name): TEST\_Logstash_ > > _node.name [http://node.name](http://node.name): "server2"_ > > _path.data: /data/elasticsearch_ > > _discovery.zen.ping.multicast.enabled: false_ > > _discovery.zen.ping.unicast.hosts: ["server1:9300", "server2:9300"]_ > > _monitor.jvm.gc.young.warn: 500ms_ > > _monitor.jvm.gc.young.info [http://monitor.jvm.gc.young.info](http://monitor.jvm.gc.young.info): 200ms_ > > _monitor.jvm.gc.old.warn: 5s_ > > _monitor.jvm.gc.old.info [http://monitor.jvm.gc.old.info](http://monitor.jvm.gc.old.info): 2s_ > > > > _Cheers_ > > _Chris_ > > > > -- > > You received this message because you are subscribed to the Google Groups > > "elasticsearch" group. > > To unsubscribe from this group and stop receiving emails from it, send an > > email to [elasticsearc...@googlegroups.com](mailto:elasticsearc...@googlegroups.com) \. > > To view this discussion on the web visit > > [https://groups.google.com/d/msgid/elasticsearch/4b2aa171-b2cc-4241-bd74-41cb50bb9009%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/4b2aa171-b2cc-4241-bd74-41cb50bb9009%40googlegroups.com) > > [https://groups.google.com/d/msgid/elasticsearch/4b2aa171-b2cc-4241-bd74-41cb50bb9009%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/4b2aa171-b2cc-4241-bd74-41cb50bb9009%40googlegroups.com?utm_medium=email&utm_source=footer) > > . > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/4aea7c7d-5d13-465d-8891-bb96789be1d7%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/4aea7c7d-5d13-465d-8891-bb96789be1d7%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). * * * 1. ^# ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 12:41am UTC](https://discuss.elastic.co/t/elasticsearch-gets-unresponsive-with-logstash/21393/4 "2017-07-06T00:41:39Z")