# How to get alerts for logstash failures of plugins / input / filters?

**URL:** https://discuss.elastic.co/t/how-to-get-alerts-for-logstash-failures-of-plugins-input-filters/27087
**Category:** Logstash
**Created:** [August 9, 2015, 11:46am UTC](https://discuss.elastic.co/t/how-to-get-alerts-for-logstash-failures-of-plugins-input-filters/27087 "2015-08-09T11:46:21Z")
**Posts on this page:** 8
**Page:** 1

<div class="post-metadata">

### Author: ![KrishnaPG](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/krishnapg/32/4111_2.png) [@KrishnaPG](https://discuss.elastic.co/u/KrishnaPG)
#### Post date: [August 9, 2015, 11:46am UTC](https://discuss.elastic.co/t/how-to-get-alerts-for-logstash-failures-of-plugins-input-filters/27087/1 "2015-08-09T11:46:21Z")

</div>

Inside logstash, what is the official mechanism to know about any critical errors that happen with plugins / inputs / filters during the production run?

For example, I am using `http_poller` input and `elastic` output. Say, if for some reason the `http_poller` is unable to read the input properly from the url or `elastic` unable to save the output - is there anyway I can configure logstash to send me alert mails ?

Generating debug / stdout errors to console would not help in backend systems case - right?

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 9, 2015, 6:16pm UTC](https://discuss.elastic.co/t/how-to-get-alerts-for-logstash-failures-of-plugins-input-filters/27087/2 "2015-08-09T18:16:38Z")

</div>

There's no "official" method here and Logstash has no built-in alerting mechanism. What you can do is use the [heartbeat input plugin](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-heartbeat.html) to periodically generate stimuli (see the [How to check Logstash's pulse](https://www.elastic.co/blog/how-to-check-logstashs-pulse) blog post from May) and feed those messages and the http\_poller messages to some other system that notices if messages stop coming. I'd recommend [Lovebeat](https://github.com/boivie/lovebeat), which offers self-learning detection of changes in heartbeat frequency and supports both Graphite and statsd input (both of which are also supported by Logstash).

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [August 9, 2015, 10:21pm UTC](https://discuss.elastic.co/t/how-to-get-alerts-for-logstash-failures-of-plugins-input-filters/27087/3 "2015-08-09T22:21:43Z")

</div>

This is something that we are working to release in 2.X, so it won't be far off!

---

<div class="post-metadata">

### Author: ![Andrew\_Cholakian1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrew_cholakian1/32/3612_2.png) [@Andrew\_Cholakian1](https://discuss.elastic.co/u/Andrew_Cholakian1)
#### Post date: [August 19, 2015, 4:17pm UTC](https://discuss.elastic.co/t/how-to-get-alerts-for-logstash-failures-of-plugins-input-filters/27087/4 "2015-08-19T16:17:08Z")

</div>

The HTTP poller will emit a special failure event in this case. You can detect it and act on it in your logstash pipeline, or use watcher to check for those events in your elasticsearch database (which is a little easier).

---

<div class="post-metadata">

### Author: ![acannon828](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/acannon828/32/8707_2.png) [@acannon828](https://discuss.elastic.co/u/acannon828)
#### Post date: [March 27, 2016, 3:21am UTC](https://discuss.elastic.co/t/how-to-get-alerts-for-logstash-failures-of-plugins-input-filters/27087/5 "2016-03-27T03:21:21Z")

</div>

@warkolm What's the latest on this?

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [March 27, 2016, 6:02am UTC](https://discuss.elastic.co/t/how-to-get-alerts-for-logstash-failures-of-plugins-input-filters/27087/6 "2016-03-27T06:02:10Z")

</div>

It's been pushed to 5.X, we'll have a number of API calls you can make to get this info.  
Check out [https://www.elastic.co/elasticon/conf/2016/sf/whats-the-latest-in-logstash](https://www.elastic.co/elasticon/conf/2016/sf/whats-the-latest-in-logstash) for more

---

<div class="post-metadata">

### Author: ![elvarb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elvarb/32/44840_2.png) [@elvarb](https://discuss.elastic.co/u/elvarb)
#### Post date: [March 29, 2016, 11:47am UTC](https://discuss.elastic.co/t/how-to-get-alerts-for-logstash-failures-of-plugins-input-filters/27087/7 "2016-03-29T11:47:28Z")

</div>

Check out Elastalert, you can configure it to query elasticsearch every X and alert if something specific happens or something unspecific like there is a flatline.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:04am UTC](https://discuss.elastic.co/t/how-to-get-alerts-for-logstash-failures-of-plugins-input-filters/27087/8 "2017-07-06T05:04:57Z")

</div>


