# How does Filebeat manage problems connecting to Logstash?

**URL:** <https://discuss.elastic.co/t/how-does-filebeat-manage-problems-connecting-to-logstash/34800>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [November 17, 2015, 12:51pm UTC](https://discuss.elastic.co/t/how-does-filebeat-manage-problems-connecting-to-logstash/34800 "2015-11-17T12:51:07Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![vmcano](https://avatars.discourse-cdn.com/v4/letter/v/f1d935/32.png) [@vmcano](https://discuss.elastic.co/u/vmcano)\
**Post date:** [November 17, 2015, 12:51pm UTC](https://discuss.elastic.co/t/how-does-filebeat-manage-problems-connecting-to-logstash/34800/1 "2015-11-17T12:51:07Z")

</div>

Hello all,

I'd like to know how Filebeat behaves when it can't connect with Logstash.

From the libbeat documentation, in case Logstash is down (or there is a network problem that prevent it reaching Logstash), Filebeat waits for an answer for a specific time defined by the `timeout` parameter. In this case, it will retry for a maximum number defined by `max_retries`. In case it doesn't succeed either, libbeat documentation says: "If an event is dropped by the output plugin, each Beat implementation must determine whether to drop the event or try sending it again." What is the default behaviour of Filebeat?

In the previous situation, imagine there are 30 events that should be sent and the first delivery fails. Will it try the whole same process for the remaining 29 events or are they treated as a package and if one fails, the whole package fails?

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [November 17, 2015, 5:11pm UTC](https://discuss.elastic.co/t/how-does-filebeat-manage-problems-connecting-to-logstash/34800/2 "2015-11-17T17:11:34Z")

</div>

Filebeat guarantees send at least once for every single event. If Logstash is not available internal queues in filebeat will fill up and filebeat stops reading from already opened files until Logstash is available again (or some other logstash instance is available).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 9:58pm UTC](https://discuss.elastic.co/t/how-does-filebeat-manage-problems-connecting-to-logstash/34800/3 "2017-07-05T21:58:10Z")

</div>