# How to restart ELK when it is stopped **URL:** \ **Category:** Logstash\ **Created:** [December 24, 2017, 5:30pm UTC](https://discuss.elastic.co/t/how-to-restart-elk-when-it-is-stopped/113108 "2017-12-24T17:30:59Z")\ **Posts on this page:** 16\ **Page:** 1
**Author:** ![bsongcc](https://avatars.discourse-cdn.com/v4/letter/b/898d66/32.png) [@bsongcc](https://discuss.elastic.co/u/bsongcc)\ **Post date:** [December 24, 2017, 5:31pm UTC](https://discuss.elastic.co/t/how-to-restart-elk-when-it-is-stopped/113108/1 "2017-12-24T17:31:00Z")
I am using ELK and the Twitter API to scrape data from twitter. It has been going for more than a week and suddenly stopped working. I am not sure if it is due to the "limits of total fields in index has been exceeded" error or other reasons. Although this error message has shown up during the week but the process kept going except this time. I don't care about the reason it stopped. I just want it to restart again and still put the data into the existing index, instead of starting a new index. Is there a way to do that? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [December 24, 2017, 8:30pm UTC](https://discuss.elastic.co/t/how-to-restart-elk-when-it-is-stopped/113108/2 "2017-12-24T20:30:14Z")
FYI we’ve renamed ELK to the Elastic Stack, otherwise Beats and APM feel left out! 😉 What OS are you on? How did you install things? ---
**Author:** ![bsongcc](https://avatars.discourse-cdn.com/v4/letter/b/898d66/32.png) [@bsongcc](https://discuss.elastic.co/u/bsongcc)\ **Post date:** [December 24, 2017, 8:54pm UTC](https://discuss.elastic.co/t/how-to-restart-elk-when-it-is-stopped/113108/3 "2017-12-24T20:54:19Z")
Ok, I will use Elastic Stack from now on. Thanks for getting back to me on a holiday break. I am using MacPro laptop. Installed everything in terminal with Java 1.8.0 background on the local computer and running it as one node, local host. I am using the Twitter API to acquire data from Twitter. It has been working for more than 10 days and this morning all of a sudden no new hits are coming in to the elastic search. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [December 24, 2017, 9:07pm UTC](https://discuss.elastic.co/t/how-to-restart-elk-when-it-is-stopped/113108/4 "2017-12-24T21:07:55Z")
What do the logs show then? ---
**Author:** ![bsongcc](https://avatars.discourse-cdn.com/v4/letter/b/898d66/32.png) [@bsongcc](https://discuss.elastic.co/u/bsongcc)\ **Post date:** [December 24, 2017, 9:14pm UTC](https://discuss.elastic.co/t/how-to-restart-elk-when-it-is-stopped/113108/5 "2017-12-24T21:14:09Z")
It shows nothing. It's just when I used the command " curl 'localhost:9200/\_cat/indices?v' " the index is not showing increase in the number of hits here is a screen shot ![08 PM](https://us1.discourse-cdn.com/elastic/original/3X/4/2/427c37055856ea82bcf8495d70711caa8106b605.jpg) ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [December 24, 2017, 10:35pm UTC](https://discuss.elastic.co/t/how-to-restart-elk-when-it-is-stopped/113108/6 "2017-12-24T22:35:50Z")
Please don't post pictures of text, they are difficult to read and some people may not be even able to see them 🙂 What version are you on? ---
**Author:** ![bsongcc](https://avatars.discourse-cdn.com/v4/letter/b/898d66/32.png) [@bsongcc](https://discuss.elastic.co/u/bsongcc)\ **Post date:** [December 24, 2017, 10:49pm UTC](https://discuss.elastic.co/t/how-to-restart-elk-when-it-is-stopped/113108/7 "2017-12-24T22:49:05Z")
Sorry I didn't know about the text in pictures are not a good way of presentation. I am on elastic stack 6.0. all are the most up-to-date versions. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [December 25, 2017, 12:07am UTC](https://discuss.elastic.co/t/how-to-restart-elk-when-it-is-stopped/113108/8 "2017-12-25T00:07:37Z")
You will likely need to enable debug logs to see what is happening. However I have noticed this same problem with the Twitter input, it's usually due to a network interruption. ---
**Author:** ![bsongcc](https://avatars.discourse-cdn.com/v4/letter/b/898d66/32.png) [@bsongcc](https://discuss.elastic.co/u/bsongcc)\ **Post date:** [December 25, 2017, 3:24am UTC](https://discuss.elastic.co/t/how-to-restart-elk-when-it-is-stopped/113108/9 "2017-12-25T03:24:49Z")
I think you are right. I am doing this from my home and I know that my connection has interruptions once in a while. I am not dealing with critical log monitoring or anything. But I do want to accumulate large enough twitter hits into one index for my final analysis. Therefore I am wondering, is there a way for me to either restart the instance under the same index name or a way to combine the separate indices into one single index for the purpose of analysis. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [December 25, 2017, 8:00am UTC](https://discuss.elastic.co/t/how-to-restart-elk-when-it-is-stopped/113108/10 "2017-12-25T08:00:36Z")
> [@bsongcc](#): > > But I do want to accumulate large enough twitter hits into one index for my final analysis. Therefore I am wondering, is there a way for me to either restart the instance under the same index name or a way to combine the separate indices into one single index for the purpose of analysis. It'll do this out of the box. Why are you changing the index? ---
**Author:** ![bsongcc](https://avatars.discourse-cdn.com/v4/letter/b/898d66/32.png) [@bsongcc](https://discuss.elastic.co/u/bsongcc)\ **Post date:** [December 26, 2017, 3:59am UTC](https://discuss.elastic.co/t/how-to-restart-elk-when-it-is-stopped/113108/11 "2017-12-26T03:59:33Z")
So you are saying I can just restart the logstash using the same config file? I probably need to Ctrl + C out of everything and restart the computer to start everything again, right? Because last time I ran into a problem when trying to restart the logstash, the systems said "there's an instance already running with the same config", that's why I had to give it a different index name to get the process going again. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [December 26, 2017, 4:13am UTC](https://discuss.elastic.co/t/how-to-restart-elk-when-it-is-stopped/113108/12 "2017-12-26T04:13:55Z")
> [@bsongcc](#): > > So you are saying I can just restart the logstash using the same config file? Yes. > [@bsongcc](#): > > I probably need to Ctrl + C out of everything and restart the computer to start everything again, right? No. > [@bsongcc](#): > > Because last time I ran into a problem when trying to restart the logstash, the systems said "there's an instance already running with the same config", that's why I had to give it a different index name to get the process going again. Sounds like you didn't properly exit things then. ---
**Author:** ![bsongcc](https://avatars.discourse-cdn.com/v4/letter/b/898d66/32.png) [@bsongcc](https://discuss.elastic.co/u/bsongcc)\ **Post date:** [December 26, 2017, 4:36am UTC](https://discuss.elastic.co/t/how-to-restart-elk-when-it-is-stopped/113108/13 "2017-12-26T04:36:07Z")
Should I just leave the Elastic search and Kibana on and just "ctrl + c" the logstash and then restart logstash? Do I need to go back to the /logstash-6.0.0/bin folder to do the "ctrl + C" and then restart the logstash by "./logstash -f indexname.conf" ? ---
**Author:** ![bsongcc](https://avatars.discourse-cdn.com/v4/letter/b/898d66/32.png) [@bsongcc](https://discuss.elastic.co/u/bsongcc)\ **Post date:** [December 26, 2017, 4:38am UTC](https://discuss.elastic.co/t/how-to-restart-elk-when-it-is-stopped/113108/14 "2017-12-26T04:38:34Z")
This is what I got by doing the list of thing I mentioned above. "[2017-12-25T23:32:34,817][FATAL][logstash.runner] Logstash could not be started because there is already another instance using the configured data directory. If you wish to run multiple instances, you must change the "path.data" setting." But I don't want to run multiple instances, I just want the logstash start again and keep putting data into the original index where it drop off from, instead of starting a new index. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [December 31, 2017, 1:41pm UTC](https://discuss.elastic.co/t/how-to-restart-elk-when-it-is-stopped/113108/15 "2017-12-31T13:41:30Z")
With Logstash shut down, delete the left-over lock file from the data directory. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 28, 2018, 1:41pm UTC](https://discuss.elastic.co/t/how-to-restart-elk-when-it-is-stopped/113108/16 "2018-01-28T13:41:36Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.