# Filebeat doesn't resume transmission to logstash after connection interruption

**URL:** <https://discuss.elastic.co/t/filebeat-doesnt-resume-transmission-to-logstash-after-connection-interruption/45087>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [March 22, 2016, 10:05am UTC](https://discuss.elastic.co/t/filebeat-doesnt-resume-transmission-to-logstash-after-connection-interruption/45087 "2016-03-22T10:05:51Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Qtax](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/qtax/32/8596_2.png) [@Qtax](https://discuss.elastic.co/u/Qtax)\
**Post date:** [March 22, 2016, 10:05am UTC](https://discuss.elastic.co/t/filebeat-doesnt-resume-transmission-to-logstash-after-connection-interruption/45087/1 "2016-03-22T10:05:51Z")

</div>

_Reporting this here since [https://github.com/elastic/beats/issues/new](https://github.com/elastic/beats/issues/new) told me to._

* * *

We have filebeat running on several (Ubuntu) servers and transmitting logs to logstash on another server (also Ubuntu) (logstash sends the parsed data to ElasticSearch for storage.)

There was a firewall issue and the filebeat nodes were unable to access the logstash server for a couple of days.

After the issue was fixed and the filebeat servers had access to the logstash server again they didn't resume sending data to logstash.

Restarting the filebeat service resumed transmission.

One of the nodes may have resumed transmission, altho I'm not sure if I just have restarted it at that time. This is why at a glance it looked like the data was transmitting for us. For the other nodes this was not noticed for some days, so we "lost" the rotated log data.

* * *

Filebeat version: 1.0.1 (I don't recall seeing in the change logs any changes related to this since this version)  
Logstash version: 2.1.1  
OS: Ubutnu 14.04 LTS

* * *

_PS: Thanks forum admins for silly password requirements on sites I don't care about._

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [March 22, 2016, 11:34am UTC](https://discuss.elastic.co/t/filebeat-doesnt-resume-transmission-to-logstash-after-connection-interruption/45087/2 "2016-03-22T11:34:45Z")

</div>

This is a known bug being fixed in filebeat 1.1.1. Pre 1.1.1, if connection is unreachable for too long time or connection get's lost too often there is a chance filebeat won't be able to reconnect to logstash.

---

<div class="post-metadata">

**Author:** ![Qtax](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/qtax/32/8596_2.png) [@Qtax](https://discuss.elastic.co/u/Qtax)\
**Post date:** [March 22, 2016, 12:00pm UTC](https://discuss.elastic.co/t/filebeat-doesnt-resume-transmission-to-logstash-after-connection-interruption/45087/3 "2016-03-22T12:00:43Z")

</div>

@steffens, great. So this is fixed in filebeat 1.1.2 already?

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [March 22, 2016, 12:17pm UTC](https://discuss.elastic.co/t/filebeat-doesnt-resume-transmission-to-logstash-after-connection-interruption/45087/4 "2016-03-22T12:17:34Z")

</div>

yes, fix is available since 1.1.1

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 9:54pm UTC](https://discuss.elastic.co/t/filebeat-doesnt-resume-transmission-to-logstash-after-connection-interruption/45087/5 "2017-07-05T21:54:20Z")

</div>