# How to monitor that logstash has stopped listening on tcp listener?

**URL:** <https://discuss.elastic.co/t/how-to-monitor-that-logstash-has-stopped-listening-on-tcp-listener/108259>\
**Category:** Logstash\
**Created:** [November 19, 2017, 3:38am UTC](https://discuss.elastic.co/t/how-to-monitor-that-logstash-has-stopped-listening-on-tcp-listener/108259 "2017-11-19T03:38:45Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jose\_Ramierez](https://avatars.discourse-cdn.com/v4/letter/j/4bbf92/32.png) [@Jose\_Ramierez](https://discuss.elastic.co/u/Jose_Ramierez)\
**Post date:** [November 19, 2017, 3:38am UTC](https://discuss.elastic.co/t/how-to-monitor-that-logstash-has-stopped-listening-on-tcp-listener/108259/1 "2017-11-19T03:38:46Z")

</div>

Logstash 5.6.4, on CentOS

We are exploring the logstash monitoring system.

Specifically, we see logstash run fine for awhile, but then stop listening on TCP, and the logstash log (/var/log/logstash/logstash-plain.log) fills with:

`[2017-11-17T00:05:44,321][ERROR][logstash.outputs.elasticsearch] Encountered a retryable error. Will Retry with exponential backoff {:code=>400, :url=>"http://<IP of ES server>:9200/_bulk"}`

So far, we do not see any monitor tags that will tell us that errors are occurring, or that the tcp listener is hung.

We looked at a number of monitor stats, when the system was hung (output is here: [https://pastebin.com/Aysn229G](https://pastebin.com/Aysn229G) ), and have not spotted a monitor that would alert us to the problem.

What are we missing?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 17, 2017, 3:39am UTC](https://discuss.elastic.co/t/how-to-monitor-that-logstash-has-stopped-listening-on-tcp-listener/108259/2 "2017-12-17T03:39:13Z")

</div>

Closed on December 17, 2017, 3:39am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
