# Filebeat to Logstash - "client is not connected" **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [January 24, 2018, 10:03pm UTC](https://discuss.elastic.co/t/filebeat-to-logstash-client-is-not-connected/116932 "2018-01-24T22:03:04Z")\ **Posts on this page:** 13\ **Page:** 2
**Author:** ![ijazadm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ijazadm/32/26662_2.png) [@ijazadm](https://discuss.elastic.co/u/ijazadm)\ **Post date:** [January 26, 2018, 4:32pm UTC](https://discuss.elastic.co/t/filebeat-to-logstash-client-is-not-connected/116932/21 "2018-01-26T16:32:07Z")
[logstash gist](https://gist.githubusercontent.com/iahmad-khan/e0bfaea744eaa8ff201212b7bf68930e/raw/e26972ba84084ad485424a08e85af269a7b3cc92/logstash%2520log) ---
**Author:** ![ijazadm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ijazadm/32/26662_2.png) [@ijazadm](https://discuss.elastic.co/u/ijazadm)\ **Post date:** [January 26, 2018, 4:38pm UTC](https://discuss.elastic.co/t/filebeat-to-logstash-client-is-not-connected/116932/22 "2018-01-26T16:38:14Z")
maybe its related to this? > but why its running ok for 5 minutes? now i reset the bulksize to 256 , restart filebeat , amd logstash and everything is back to normal. ---
**Author:** ![pierhugues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pierhugues/32/48383_2.png) [@pierhugues](https://discuss.elastic.co/u/pierhugues)\ **Post date:** [January 26, 2018, 4:38pm UTC](https://discuss.elastic.co/t/filebeat-to-logstash-client-is-not-connected/116932/23 "2018-01-26T16:38:44Z")
I don't see anything in the currently provided log anything that could make Logstash in a crash state. Any errors after the following lines?: ```auto [2018-01-26T16:19:50,886][TRACE][org.logstash.beats.BeatsParser] Transition, from: READ_HEADER, to: READ_FRAME_TYPE, requiring 1 bytes [2018-01-26T16:19:50,886][TRACE][org.logstash.beats.BeatsParser] Transition, from: READ_FRAME_TYPE, to: READ_JSON_HEADER, requiring 8 bytes ``` Also can you add your Logstash pipeline configuration, make sure to remove any credentials. ---
**Author:** ![ijazadm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ijazadm/32/26662_2.png) [@ijazadm](https://discuss.elastic.co/u/ijazadm)\ **Post date:** [January 26, 2018, 4:47pm UTC](https://discuss.elastic.co/t/filebeat-to-logstash-client-is-not-connected/116932/24 "2018-01-26T16:47:17Z")
No errors after that. the only erro i see in logstash is that cgroup related. everything is running on docker 13 , elasticsearch , logstash and kibana. logstash pipeline: ``` bash-4.2$ cat /usr/share/logstash/pipeline/logstash.conf input { beats { port => "5043" client_inactivity_timeout => 40000 } } filter { grok { match => { "message" => "%{COMBINEDAPACHELOG}"} } ip2location { source => "clientip" database => "/usr/share/logstash/ip2location.BIN" } geoip { source => "clientip" } } output { elasticsearch { hosts => ["localhost:9200"] } } ``` ---
**Author:** ![pierhugues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pierhugues/32/48383_2.png) [@pierhugues](https://discuss.elastic.co/u/pierhugues)\ **Post date:** [January 26, 2018, 4:56pm UTC](https://discuss.elastic.co/t/filebeat-to-logstash-client-is-not-connected/116932/25 "2018-01-26T16:56:54Z")
> [@Filebeat to Logstash - "client is not connected"](https://discuss.elastic.co/t/filebeat-to-logstash-client-is-not-connected/116932/22): > > maybe its related to this? but why its running ok for 5 minutes? now i reset the bulksize to 256 , restart filebeat , amd logstash and everything is back to normal. That hat error should not impact your ingestion, its done in another thread and this logging is from a rescue. ---
**Author:** ![ijazadm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ijazadm/32/26662_2.png) [@ijazadm](https://discuss.elastic.co/u/ijazadm)\ **Post date:** [January 26, 2018, 4:57pm UTC](https://discuss.elastic.co/t/filebeat-to-logstash-client-is-not-connected/116932/26 "2018-01-26T16:57:32Z")
the point is , all these settings and setup only works on bulk size of 256 or lower , I have 3 elk nodes each with 32 GB ram and 8 cores. ---
**Author:** ![pierhugues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pierhugues/32/48383_2.png) [@pierhugues](https://discuss.elastic.co/u/pierhugues)\ **Post date:** [January 26, 2018, 4:58pm UTC](https://discuss.elastic.co/t/filebeat-to-logstash-client-is-not-connected/116932/27 "2018-01-26T16:58:01Z")
How many clients have you connected to this Logstash instance? ---
**Author:** ![ijazadm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ijazadm/32/26662_2.png) [@ijazadm](https://discuss.elastic.co/u/ijazadm)\ **Post date:** [January 26, 2018, 4:59pm UTC](https://discuss.elastic.co/t/filebeat-to-logstash-client-is-not-connected/116932/28 "2018-01-26T16:59:06Z")
I have 3 similar logstash instance all of them same config and specs. and three clinets. each client sending to each elk , one to one mapping. all three ELKs are part of one cluster ---
**Author:** ![ijazadm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ijazadm/32/26662_2.png) [@ijazadm](https://discuss.elastic.co/u/ijazadm)\ **Post date:** [January 26, 2018, 5:00pm UTC](https://discuss.elastic.co/t/filebeat-to-logstash-client-is-not-connected/116932/29 "2018-01-26T17:00:11Z")
kibana is installed on only one of them and elasticsearch and logstash is installed on all of them. logstash ingest port is available on all of them. ---
**Author:** ![pierhugues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pierhugues/32/48383_2.png) [@pierhugues](https://discuss.elastic.co/u/pierhugues)\ **Post date:** [January 26, 2018, 5:05pm UTC](https://discuss.elastic.co/t/filebeat-to-logstash-client-is-not-connected/116932/30 "2018-01-26T17:05:35Z")
> I have 3 similar logstash instance all of them same config and specs. and three clinets. So you only have 3 Filebeat clients connected to that specific Logstash instance? If this is correct that number is pretty low and Logstash should not have any problem dealing with that. Questions: 1. Did you try removing the `ip2location` from the filter? Does this affect performance? 2. What is the output of the following command: `bin/logstash version` 3. What is the output of the following command: `bin/logstash-plugin list --verbose beats` ---
**Author:** ![ijazadm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ijazadm/32/26662_2.png) [@ijazadm](https://discuss.elastic.co/u/ijazadm)\ **Post date:** [January 29, 2018, 1:28pm UTC](https://discuss.elastic.co/t/filebeat-to-logstash-client-is-not-connected/116932/31 "2018-01-29T13:28:15Z")
hi , this time i got a new error in the log , which seems more informative ``` at java.lang.Thread.run(Thread.java:748) [?:1.8.0_151] [2018-01-28T06:53:06,717][WARN][io.netty.util.concurrent.SingleThreadEventExecutor] Unexpected exception from an event executor: java.lang.OutOfMemoryError: Java heap space [2018-01-28T07:40:48,653][ERROR][logstash.filters.grok] Error while attempting to check/cancel excessively long grok patterns {:message=>"Java heap space", :class=>"Java::JavaLang::OutOfMemoryError", :backtrace=>[]} Unhandled Java exception: java.lang.InternalError: BMH.reinvoke=Lambda(a0:L/SpeciesData,a1:L)=>{ t2:L=BoundMethodHandle$Species_LL.argL1(a0:L); t3:L=BoundMethodHandle$Species_LL.argL0(a0:L); t4:V=MethodHandle.invokeBasic(t3:L,t2:L,a1:L);void} Exception in thread "LogStash::Runner" java.lang.OutOfMemoryError: Java heap space ``` But I looked at my logstash memory config , it using 8g , which should be enough for one client.? ``` bash-4.2$ ps -aef | grep logstash logstash 1 0 99 13:09 ? 00:05:22 /bin/java -XX:+UseParNewGC -XX:+UseConcMarkSweepGC -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSInitiatingOccupancyOnly -Djava.awt.headless=true -Dfile.encoding=UTF-8 -Djruby.compile.invokedynamic=true -Djruby.jit.threshold=0 -XX:+HeapDumpOnOutOfMemoryError -Djava.security.egd=file:/dev/urandom -Xmx8g -Xms8g -Xss2048k -Djffi.boot.library.path=/usr/share/logstash/vendor/jruby/lib/jni -Xbootclasspath/a:/usr/share/logstash/vendor/jruby/lib/jruby.jar -classpath : -Djruby.home=/usr/share/logstash/vendor/jruby -Djruby.lib=/usr/share/logstash/vendor/jruby/lib -Djruby.script=jruby -Djruby.shell=/bin/sh org.jruby.Main /usr/share/logstash/lib/bootstrap/environment.rb logstash/runner.rb ``` why the OOM killer kills it? its a machine with 32g ram , 16gb for elastic heap size and 8g configured for lostash , and still 8g for other stuff. ---
**Author:** ![ijazadm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ijazadm/32/26662_2.png) [@ijazadm](https://discuss.elastic.co/u/ijazadm)\ **Post date:** [January 29, 2018, 1:29pm UTC](https://discuss.elastic.co/t/filebeat-to-logstash-client-is-not-connected/116932/32 "2018-01-29T13:29:24Z")
Is there a memory leak in logstash 6? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 26, 2018, 1:29pm UTC](https://discuss.elastic.co/t/filebeat-to-logstash-client-is-not-connected/116932/33 "2018-02-26T13:29:34Z")
Closed on February 26, 2018, 1:29pm UTC This topic was automatically closed 28 days after the last reply. New replies are no longer allowed. [Previous page](https://discuss.elastic.co/t/filebeat-to-logstash-client-is-not-connected/116932.md?page=1)