# ES output filter hangs at health check

**URL:** <https://discuss.elastic.co/t/es-output-filter-hangs-at-health-check/84310>\
**Category:** Logstash\
**Created:** [May 2, 2017, 6:15pm UTC](https://discuss.elastic.co/t/es-output-filter-hangs-at-health-check/84310 "2017-05-02T18:15:45Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![addyk](https://avatars.discourse-cdn.com/v4/letter/a/c2a13f/32.png) [@addyk](https://discuss.elastic.co/u/addyk)\
**Post date:** [May 2, 2017, 6:15pm UTC](https://discuss.elastic.co/t/es-output-filter-hangs-at-health-check/84310/1 "2017-05-02T18:15:45Z")

</div>

I posted a similar post at [about a month ago](https://discuss.elastic.co/t/logstash-elasticsearch-output-plugin-hangs-at-health-check/77040) but was not able to get any answers. Please read that link before reading the rest of this post.

The short version of my issue is ES output filter hangs at health check

```auto
Sending Logstash's logs to /usr/share/logstash/logs which is now configured via log4j2.properties
[2017-05-02T18:18:12,719][INFO][logstash.setting.writabledirectory] Creating directory {:setting=>"path.queue", :path=>"/usr/share/logstash/data/queue"}
[2017-05-02T18:18:12,821][INFO][logstash.agent] No persistent UUID file found. Generating new UUID {:uuid=>"48b96e83-de69-4f77-a213-274b4d43d7d4", :path=>"/usr/share/logstash/data/uuid"}
[2017-05-02T18:18:14,901][INFO][logstash.outputs.elasticsearch] Elasticsearch pool URLs updated {:changes=>{:removed=>[], :added=>[https://<username>:xxxxxx@cluster-id.us-east-1.aws.found.io:9243/]}}
[2017-05-02T18:18:14,903][INFO][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck_url=>https://<username>:xxxxxx@cluster-id.us-east-1.aws.found.io:9243/, :path=>"/"}

```

I upgraded my version of logstash and labeled it resolved, but I was back to having the same issue a week later. I have no idea if my logs are processing or not.

Running Logstash 5.2.2 using [elastic.co](http://elastic.co) image, not the one hosted on dockerhub, using Docker for Mac

Docker Version 17.0.1-ce-mac5 (16048), channel: Stable, 2 CPUs, 4GB memory  
Mac version 10.12.4 (Sierra)

Here's a heavily sanitized version of my logstash.conf

```auto
input { 
	stdin { type => stdin } 

  file {
    path => [<path to file as string>]
    codec => multiline {
      patterns_dir => [<path to patterns directory as string>]
      pattern => "%{TIMESTAMP_ISO8601} "
      what => "previous"
      negate => true
    }
  }
}

filter {
  grok {
    patterns_dir => [<path to patterns directory as string>]
    match => {
      "message" => <pattern as string">
    }
  }
}

output {
  stdout { codec => rubydebug }

    elasticsearch {
      hosts => ["${ELASTICSEARCH_HOST}"]
      user => "${ELASTIC_CLOUD_USER}"
      password => "${ELASTIC_CLOUD_PASSWORD}"
      index => "%{level}-%{+YYYY.MM.dd}"
    }
  }
}

```

When trying to curl I am successful.

```auto
$ curl --user $ELASTIC_CLOUD_USER:$ELASTIC_CLOUD_PASSWORD $ELASTICSEARCH_HOST/test_index/logs -d '{
"title": "One", "tags": ["ruby"]
}'
{"_index":"test_index","_type":"logs","_id":"AVvKXcXdOU-C_fihO7_D","_version":1,"result":"created","_shards":{"total":2,"successful":1,"failed":0},"created":true}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 30, 2017, 6:25pm UTC](https://discuss.elastic.co/t/es-output-filter-hangs-at-health-check/84310/2 "2017-05-30T18:25:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.