# INFO: I/O exception

**URL:** <https://discuss.elastic.co/t/info-i-o-exception/2761>\
**Category:** Logstash\
**Created:** [June 16, 2015, 6:03am UTC](https://discuss.elastic.co/t/info-i-o-exception/2761 "2015-06-16T06:03:13Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Silver](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/silver/32/19894_2.png) [@Silver](https://discuss.elastic.co/u/Silver)\
**Post date:** [June 16, 2015, 6:03am UTC](https://discuss.elastic.co/t/info-i-o-exception/2761/1 "2015-06-16T06:03:13Z")

</div>

This is my setup

IIS Server --\> logstash-forwarder --\> 2 logstash instances (fqdn certs) --\> haproxy --\> 2 elasticsearch node

The logstash-forwarder is working and my cluster is also mostly in green.. but out of nowhere for no reason logstash-forwarder seems to stop.

had a look at the logs in the logstash instances and this is what i found

/var/log/logstash/logstash.err

INFO: I/O exception (org.apache.http.NoHttpResponseException) caught when processing request to {}-\>[http://xx.xx.x.123:9200](http://xx.xx.x.123:9200): The target server failed to respond  
Jun 16, 2015 9:04:56 AM org.apache.http.impl.execchain.RetryExec execute  
INFO: Retrying request to {}-\>[http://xx.xx.xx.123:9200](http://xx.xx.xx.123:9200)

[http://xx.xx.xx.123:9200](http://xx.xx.xx.123:9200) \<-- this is my haproxy ip!

This is my logstash output config

```
output {
    if "_grokparsefailure" not in [tags] {
            elasticsearch {
                    cluster => "elkstackz"
                    host => "xx.xx.xx.123"
                    protocol => "http"
                    user => "xxxx"
                    password => "xxxxx"
            }
    }
    file {
            tags => "_grokparsefailure_sysloginput"
            path => "/var/log/grokparsefailure"
    }
}

```

Is this because the 2 elastic nodes are having bad I/O? I am not using an SSD. Anyways i guess its failing from the haproxy?

regards,

Ismail

---

<div class="post-metadata">

**Author:** ![Joshua\_Rich](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joshua_rich/32/44953_2.png) [@Joshua\_Rich](https://discuss.elastic.co/u/Joshua_Rich)\
**Post date:** [June 16, 2015, 6:32am UTC](https://discuss.elastic.co/t/info-i-o-exception/2761/2 "2015-06-16T06:32:13Z")

</div>

I'd be checking your HAproxy logs.

Also note that when using `protocol => "http"` for the elasticsearch Logstash output, you can pass an array of Elasticsearch nodes to the `host` parameter and the output plugin will load balance the bulk requests between them. So you could essentially drop HAproxy out of the pipeline by specifying you Logstash output like:

```auto
elasticsearch {
                    cluster => "elkstackz"
                    host => ["xx.xx.xx.124", "xx.xx.xx.125"]
                    protocol => "http"
                    user => "xxxx"
                    password => "xxxxx"
            }

```

Where `xx.xx.xx.124` and `xx.xx.xx.125` are you Elasticsearch nodes.

---

<div class="post-metadata">

**Author:** ![Silver](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/silver/32/19894_2.png) [@Silver](https://discuss.elastic.co/u/Silver)\
**Post date:** [June 16, 2015, 7:54am UTC](https://discuss.elastic.co/t/info-i-o-exception/2761/3 "2015-06-16T07:54:22Z")

</div>

Thanks, I will get rid of the HAProxy this way. but anyways i found my issue.

iis w3svc log format sets the timezone to GMT.. so my logs were showing a backdate.. i thought logstash-forwarder was having some issue.

[https://support.microsoft.com/en-us/kb/271196](https://support.microsoft.com/en-us/kb/271196)

i need to change it to microsoft iis log format to be able to change the timezone so it actually starts logging with the proper time..

but i am still curious about the error messages i saw in the logstash.err with INFO: I/O exception. Anyways thanks 🙂 This project is fantastic.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:37am UTC](https://discuss.elastic.co/t/info-i-o-exception/2761/4 "2017-07-06T05:37:22Z")

</div>