# Filebeat To Logstash caused circuit break errors

**URL:** <https://discuss.elastic.co/t/filebeat-to-logstash-caused-circuit-break-errors/66494>\
**Category:** Logstash\
**Created:** [November 18, 2016, 7:35am UTC](https://discuss.elastic.co/t/filebeat-to-logstash-caused-circuit-break-errors/66494 "2016-11-18T07:35:43Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![locolbd](https://avatars.discourse-cdn.com/v4/letter/l/ce73a5/32.png) [@locolbd](https://discuss.elastic.co/u/locolbd)\
**Post date:** [November 18, 2016, 7:35am UTC](https://discuss.elastic.co/t/filebeat-to-logstash-caused-circuit-break-errors/66494/1 "2016-11-18T07:35:43Z")

</div>

First overview of the environment showing the flow of logs  
Filebeat -\> logstash(ingest) -\> Redis(Queue Messaging) -\> Logstash Filter Nodes (3) -\> Elastic Search...

We currently have syslog sending logs and it showing up in Kibana without issue.  
However we are using filebeat 5.0 or 1.3.1 to send logs to logstash 2.3.4

Once filebeat start sending logs to the logstash ingest, our grafana graph shows the high ingest but the filter does not increase with the high ingest. Moments later logstash writes this:  
"Beats input: The circuit breaker has detected a slowdown or stall in the pipeline, the input is closing the current connection and rejecting new connection until the pipeline recover.", :exception=\>LogStash::Inputs::BeatsSupport::CircuitBreaker::OpenBreaker, :level=\>:warn}...

As far as we can we see, the logs are never making it to Redis

Below are the pipelines for ingest and filter. Your assistance is greatly appreciated.

logstash(ingest) pipeline  
input {  
beats {  
port =\> "5043"  
tags =\> ["fglam"]  
type =\> "fglam-beats"  
}  
}  
output {  
if([type] == "fglam-beats")  
{  
redis {  
data\_type =\> "list"  
key =\> "logstash-fglam-beats"  
congestion\_threshold =\> "2200000"  
}  
}  
}

filternode pipeline  
input {  
redis {  
type =\> "fglam-beats"  
data\_type =\> "list"  
key =\> "logstash-fglam-beats"  
#key =\> "filebeat"  
port =\> "6379"  
host =\> "ist000216"  
add\_field =\> { "index\_name" =\> "fglam" }  
}  
}  
filter {  
if("fglam-tags" in [tags])  
{  
environment {  
add\_metadata\_from\_env =\> {  
"hostname" =\> "HOSTNAME"  
}  
}  
mutate {  
add\_tag =\> ["%{[@metadata][hostname]}" ]  
}  
grok {  
match =\> { "message" =\> "%{TIMESTAMP\_ISO8601:my\_timestamp}\s+%{SEV:severity}\s+%{CAT1:cat1}\s+%{CAT2:cat2}%{BODY:body}" }  
}  
}  
}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 22, 2016, 9:02pm UTC](https://discuss.elastic.co/t/filebeat-to-logstash-caused-circuit-break-errors/66494/2 "2016-11-22T21:02:14Z")

</div>

> As far as we can we see, the logs are never making it to Redis

None of them? Is there anything else in the Logstash log? What if you crank up the log level?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 20, 2016, 9:02pm UTC](https://discuss.elastic.co/t/filebeat-to-logstash-caused-circuit-break-errors/66494/3 "2016-12-20T21:02:22Z")

</div>

Closed on December 20, 2016, 9:02pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.