# Filebeat stops if there is any failure in ingest pipeline

**URL:** <https://discuss.elastic.co/t/filebeat-stops-if-there-is-any-failure-in-ingest-pipeline/114681>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [January 9, 2018, 10:30am UTC](https://discuss.elastic.co/t/filebeat-stops-if-there-is-any-failure-in-ingest-pipeline/114681 "2018-01-09T10:30:00Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![RohanKumbhar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rohankumbhar/32/23649_2.png) [@RohanKumbhar](https://discuss.elastic.co/u/RohanKumbhar)\
**Post date:** [January 9, 2018, 10:30am UTC](https://discuss.elastic.co/t/filebeat-stops-if-there-is-any-failure-in-ingest-pipeline/114681/1 "2018-01-09T10:30:00Z")

</div>

Hi ,

I'm using filebeat --\>ingest pipeline --\>elasticsearch , and i'm using grok processor with set of log patterns under ingest pipeline . If there any log event which is not matching with grok processor patterns then filebeat halts and it will not ship further log events. then i have to manually restart filebeat to ship next log events

note: i'm using on\_failure functionality for my pipeline but still the same issue.

Kindly help

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [January 9, 2018, 3:07pm UTC](https://discuss.elastic.co/t/filebeat-stops-if-there-is-any-failure-in-ingest-pipeline/114681/2 "2018-01-09T15:07:09Z")

</div>

There is something weird here. Especially if you are using `on_failure` which does not generate an HTTP error status.

I moved your question to #beats:filebeat. Could you provide may be more details? How you pipeline has been created, logs from filebeat?...

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [January 9, 2018, 3:08pm UTC](https://discuss.elastic.co/t/filebeat-stops-if-there-is-any-failure-in-ingest-pipeline/114681/3 "2018-01-09T15:08:58Z")

</div>

Can you also share your filebeat config, filebeat version and log output? Filebeat should not halt on error.

---

<div class="post-metadata">

**Author:** ![RohanKumbhar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rohankumbhar/32/23649_2.png) [@RohanKumbhar](https://discuss.elastic.co/u/RohanKumbhar)\
**Post date:** [January 10, 2018, 7:59am UTC](https://discuss.elastic.co/t/filebeat-stops-if-there-is-any-failure-in-ingest-pipeline/114681/4 "2018-01-10T07:59:40Z")

</div>

> [@dadoonet](#):
>
> I moved your question to #beats:filebeat. Could you provide may be more details? How you pipeline has been created, logs from filebeat?...

Thanks !! its working fine now. I was using 3 filebeat.prospector with log input\_type and each was referring to different ingest pipeline. And there was one ingest pipeline which was missing "on\_failure"  
hence the issue.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 7, 2018, 8:11am UTC](https://discuss.elastic.co/t/filebeat-stops-if-there-is-any-failure-in-ingest-pipeline/114681/5 "2018-02-07T08:11:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.