# Elasticsearch is down. What happens to output data from Logstash?

**URL:** <https://discuss.elastic.co/t/elasticsearch-is-down-what-happens-to-output-data-from-logstash/23774>\
**Category:** Logstash\
**Created:** [June 16, 2015, 5:57pm UTC](https://discuss.elastic.co/t/elasticsearch-is-down-what-happens-to-output-data-from-logstash/23774 "2015-06-16T17:57:59Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![vilas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vilas/32/613_2.png) [@vilas](https://discuss.elastic.co/u/vilas)\
**Post date:** [June 16, 2015, 5:57pm UTC](https://discuss.elastic.co/t/elasticsearch-is-down-what-happens-to-output-data-from-logstash/23774/1 "2015-06-16T17:57:59Z")

</div>

Hi,

This probably is a repeated question. But I would like to clarify this.

Elasticsearch is down suddenly on central server. But Logstash is running on remote server parsing logs.  
We started elasticsearch after few hours.

Did we loose any data? If not how Logstash is handling this?

Thanks.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [June 16, 2015, 10:19pm UTC](https://discuss.elastic.co/t/elasticsearch-is-down-what-happens-to-output-data-from-logstash/23774/2 "2015-06-16T22:19:12Z")

</div>

LS will simply stop processing, but keep running.  
Then when ES comes back up it will start sending again.

---

<div class="post-metadata">

**Author:** ![vilas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vilas/32/613_2.png) [@vilas](https://discuss.elastic.co/u/vilas)\
**Post date:** [June 16, 2015, 10:29pm UTC](https://discuss.elastic.co/t/elasticsearch-is-down-what-happens-to-output-data-from-logstash/23774/3 "2015-06-16T22:29:12Z")

</div>

> [@warkolm](#):
>
> LS will simply stop processing, but keep running.

Does LS keep trying to flush the same output to elasticsearch until it is successful?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [June 16, 2015, 10:31pm UTC](https://discuss.elastic.co/t/elasticsearch-is-down-what-happens-to-output-data-from-logstash/23774/4 "2015-06-16T22:31:44Z")

</div>

That's correct.

---

<div class="post-metadata">

**Author:** ![vilas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vilas/32/613_2.png) [@vilas](https://discuss.elastic.co/u/vilas)\
**Post date:** [June 16, 2015, 10:34pm UTC](https://discuss.elastic.co/t/elasticsearch-is-down-what-happens-to-output-data-from-logstash/23774/5 "2015-06-16T22:34:13Z")

</div>

We verified that no data is lost. This is Great..!  
Thanks @warkolm

---

<div class="post-metadata">

**Author:** ![ArivazhaganJ](https://avatars.discourse-cdn.com/v4/letter/a/c67d28/32.png) [@ArivazhaganJ](https://discuss.elastic.co/u/ArivazhaganJ)\
**Post date:** [April 21, 2016, 2:53pm UTC](https://discuss.elastic.co/t/elasticsearch-is-down-what-happens-to-output-data-from-logstash/23774/6 "2016-04-21T14:53:13Z")

</div>

Hi, We are facing similar issue. But when ES is down, getting Too many open files exception and ultimately our application server crashes.

Is there any fix/configuration like, if output ES is not reachable, do not read any event until notified.

Thanks in advance @warkolm

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [April 22, 2016, 5:12am UTC](https://discuss.elastic.co/t/elasticsearch-is-down-what-happens-to-output-data-from-logstash/23774/7 "2016-04-22T05:12:48Z")

</div>

Please start a new thread, this one is pretty old.

---

<div class="post-metadata">

**Author:** ![vilas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vilas/32/613_2.png) [@vilas](https://discuss.elastic.co/u/vilas)\
**Post date:** [April 22, 2016, 8:02pm UTC](https://discuss.elastic.co/t/elasticsearch-is-down-what-happens-to-output-data-from-logstash/23774/8 "2016-04-22T20:02:44Z")

</div>

> [@ArivazhaganJ](#):
>
> getting Too many open files exception

You need to check the number of open files allowed on your server.  
You can get that using command  
**\> ulimit -n**  
By default it would be 1024. You need to increase the number to an higher number say 64K.

That should solve your open files exception issue.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:01am UTC](https://discuss.elastic.co/t/elasticsearch-is-down-what-happens-to-output-data-from-logstash/23774/9 "2017-07-06T05:01:04Z")

</div>


