# ELK Stack upgraded, and logstash is not sending data to elasticsearch

**URL:** <https://discuss.elastic.co/t/elk-stack-upgraded-and-logstash-is-not-sending-data-to-elasticsearch/48993>\
**Category:** Logstash\
**Created:** [May 2, 2016, 7:42pm UTC](https://discuss.elastic.co/t/elk-stack-upgraded-and-logstash-is-not-sending-data-to-elasticsearch/48993 "2016-05-02T19:42:09Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![bsmitty111](https://avatars.discourse-cdn.com/v4/letter/b/4da419/32.png) [@bsmitty111](https://discuss.elastic.co/u/bsmitty111)\
**Post date:** [May 2, 2016, 7:42pm UTC](https://discuss.elastic.co/t/elk-stack-upgraded-and-logstash-is-not-sending-data-to-elasticsearch/48993/1 "2016-05-02T19:42:09Z")

</div>

Hello,

I am very new to ELK, and inherited this environment. this is not rolled out to production.

I have the following servers:  
logstash index server version 2.3  
logstash shipping server version 2.3  
elasticserach cluster (3 servers 2 data 1 master) version 2.3.2  
kibana web version 4.5

this was all working, until i upgraded all to the latest version.  
now the logs never seem to get to elastic search, all of the services are running,

I am unclear as to where to begin troubleshooting this.

Any help would be greatly appreciated.

Thank you!

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [May 2, 2016, 10:37pm UTC](https://discuss.elastic.co/t/elk-stack-upgraded-and-logstash-is-not-sending-data-to-elasticsearch/48993/2 "2016-05-02T22:37:57Z")

</div>

Have you looked at the logs for each of the applications to make sure everything is ok?

---

<div class="post-metadata">

**Author:** ![bsmitty111](https://avatars.discourse-cdn.com/v4/letter/b/4da419/32.png) [@bsmitty111](https://discuss.elastic.co/u/bsmitty111)\
**Post date:** [May 3, 2016, 11:18am UTC](https://discuss.elastic.co/t/elk-stack-upgraded-and-logstash-is-not-sending-data-to-elasticsearch/48993/3 "2016-05-03T11:18:41Z")

</div>

warkolm,  
thank you for the reply 🙂  
I am not sure where the logs are for all of the services,  
but I have checked the following.

I have checked the logfile for the logstash shipping and I see an error

{:timestamp=\>"2016-05-02T15:36:06.941000-0400", :message=\>"Error parsing json", :source=\>"message", :raw=\>"{"EventTime":"2016-05-02 15:35:57\

it looks like the logstash indexer has new events,

May 03 07:09:56 SERVER logstash[18215]: =\>"system", "UserID"=\>"SYSTEM", "AccountType"=\>"User", "Opcode"=\>"Info", "optionCode"=\>"34", "optionName"=\>"WSMAN\_OPTION\_USE\_INTEARACTIVE\_TOKEN", "optionValue"=\>"0", "tags"=\>["\_grokparsefailure"], "FileName"=\>nil, "source\_host"=\>"SERVER.mydomain", "eventlog\_severity"=\>"info", "eventlog\_severity\_code"=\>2,

---

<div class="post-metadata">

**Author:** ![bsmitty111](https://avatars.discourse-cdn.com/v4/letter/b/4da419/32.png) [@bsmitty111](https://discuss.elastic.co/u/bsmitty111)\
**Post date:** [May 3, 2016, 1:13pm UTC](https://discuss.elastic.co/t/elk-stack-upgraded-and-logstash-is-not-sending-data-to-elasticsearch/48993/4 "2016-05-03T13:13:21Z")

</div>

I have restarted the logstash service on my index node, and I have an error in the log of

:message=\>"Failed action. ", :status=\>400, :action=\>["index", {:\_id=\>nil, :\_index=\>"logstash-2016.05.03",

---

<div class="post-metadata">

**Author:** ![bsmitty111](https://avatars.discourse-cdn.com/v4/letter/b/4da419/32.png) [@bsmitty111](https://discuss.elastic.co/u/bsmitty111)\
**Post date:** [May 3, 2016, 2:33pm UTC](https://discuss.elastic.co/t/elk-stack-upgraded-and-logstash-is-not-sending-data-to-elasticsearch/48993/5 "2016-05-03T14:33:02Z")

</div>

nevermind I got this all fixed bu rebooting all of the servers .

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:59am UTC](https://discuss.elastic.co/t/elk-stack-upgraded-and-logstash-is-not-sending-data-to-elasticsearch/48993/6 "2017-07-06T04:59:32Z")

</div>


