# Logs are no longer sent to elasticsearch
**URL:** https://discuss.elastic.co/t/logs-are-no-longer-sent-to-elasticsearch/260378
**Category:** Elasticsearch
**Created:** [January 6, 2021, 6:39pm UTC](https://discuss.elastic.co/t/logs-are-no-longer-sent-to-elasticsearch/260378 "2021-01-06T18:39:19Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@Falikou1](https://discuss.elastic.co/u/Falikou1)
#### Post date: [January 6, 2021, 6:39pm UTC](https://discuss.elastic.co/t/logs-are-no-longer-sent-to-elasticsearch/260378/1 "2021-01-06T18:39:19Z")
I receive the logs in logstash, but the logs are no longer sent to elasticsearch.
Can you help me?
Below are the logs in logstash:
[root@scs90104vu logstash]# tail -f /var/log/logstash/logstash-plain.log
[2021-01-06T19:16:36,721][ERROR][logstash.outputs.elasticsearchmonitoring][.monitoring-logstash][6c45b54763a2a7ed3b18c8990c8e354a513b00153cae651e97cfc5dc5b267193] Encountered a retryable error. Will Retry with exponential backoff {:code=\>500, :url=\>"[https://ELASTIC1:9200/\_monitoring/bulk?system\_id=logstash&system\_api\_version=7&interval=1s](https://ELASTIC1:9200/_monitoring/bulk?system_id=logstash&system_api_version=7&interval=1s)"}
[2021-01-06T19:17:40,741][ERROR][logstash.outputs.elasticsearchmonitoring][.monitoring-logstash][6c45b54763a2a7ed3b18c8990c8e354a513b00153cae651e97cfc5dc5b267193] Encountered a retryable error. Will Retry with exponential backoff {:code=\>500, :url=\>"[https://ELASTIC2:9200/\_monitoring/bulk?system\_id=logstash&system\_api\_version=7&interval=1s](https://ELASTIC2:9200/_monitoring/bulk?system_id=logstash&system_api_version=7&interval=1s)"}
[2021-01-06T19:18:44,761][ERROR][logstash.outputs.elasticsearchmonitoring][.monitoring-logstash][6c45b54763a2a7ed3b18c8990c8e354a513b00153cae651e97cfc5dc5b267193] Encountered a retryable error. Will Retry with exponential backoff {:code=\>500, :url=\>"[https://ELASTIC2:9200/\_monitoring/bulk?system\_id=logstash&system\_api\_version=7&interval=1s](https://ELASTIC2:9200/_monitoring/bulk?system_id=logstash&system_api_version=7&interval=1s)"}
[2021-01-06T19:19:48,781][ERROR][logstash.outputs.elasticsearchmonitoring][.monitoring-logstash][6c45b54763a2a7ed3b18c8990c8e354a513b00153cae651e97cfc5dc5b267193] Encountered a retryable error. Will Retry with exponential backoff {:code=\>500, :url=\>"[https://ELASTIC1:9200/\_monitoring/bulk?system\_id=logstash&system\_api\_version=7&interval=1s](https://ELASTIC1:9200/_monitoring/bulk?system_id=logstash&system_api_version=7&interval=1s)"}
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [January 6, 2021, 8:26pm UTC](https://discuss.elastic.co/t/logs-are-no-longer-sent-to-elasticsearch/260378/2 "2021-01-06T20:26:57Z")
What does your Logstash config look like?
What version are you on?
What do your Elasticsearch logs look like?
What is the output from the `_cluster/stats?pretty&human` API?
---
### Author:  [@Falikou1](https://discuss.elastic.co/u/Falikou1)
#### Post date: [January 7, 2021, 5:15pm UTC](https://discuss.elastic.co/t/logs-are-no-longer-sent-to-elasticsearch/260378/3 "2021-01-07T17:15:54Z")
What does your Logstash config look like?
input {
tcp {
port =\> "5141"
codec =\> json
type =\> "syslog"
}
}
filter {
grok {
match =\> { "message" =\> "%{SYSLOG5424PRI:syslog\_index}-\s\*%{SYSLOGHOST:syslog\_hostname} %{GREEDYDATA:syslog\_message}" }
}
json
{
source =\> "syslog\_message"
}
}
output {
stdout { codec =\> rubydebug }
elasticsearch {
hosts =\> ["[https://ELASTIC1:9200](https://ELASTIC1:9200)", "[https://ELASTIC2:9200](https://ELASTIC2:9200)"]
user =\> "elastic"
password =\> "xxxxxxx"
cacert =\> "/etc/logstash/certs/ca.crt"
index =\> "jstest-%{+YYYY.MM.dd}"
action =\> "index"
}
}
What version are you on?
7.8
What do your Elasticsearch logs look like?
\<01\>-.hostname.{"name":"DefaultProfile","version":"1.0","isoTimeFormat":"yyyy-MM-dd'T'HH:mm:ss.SSSZ","type":"Event","category":"deny","protocolID":"6","sev":"4","src":"10.66.7.32","dst":"192.168.2.111","srcPort":"63298","dstPort":"445","relevance":"5","credibility":"5","startTimeEpoch":"1609264894432","startTimeISO":"2020-12-29T19:01:34.432+01:00","storageTimeEpoch":"1609264894432","storageTimeISO":"2020-12-29T19:01:34.432+01:00","deploymentID":"5c15c102-a647-11ea-8226-00505601062b","devTimeEpoch":"1609264893000","devTimeISO":"2020-12-29T19:01:33.000+01:00","srcPreNATPort":"0","dstPreNATPort":"0","srcPostNATPort":"0","dstPostNATPort":"0","hasIdentity":"false","payload":"\<189\>timestamp=1609264893.devname="DCL0001FW".devid="FG100FTK20004077".vd="VPN-PARTNER".date=2020-12-29.time=19:01:33.logid="000000001".type="traffic".subtype="forward".level="notice".eventtime=1609264893808550963.tz="+0100".srcip=10.66.7.32.srcport=63298.srcintf="To-GCP".srcintfrole="undefined".dstip=192.168.2.111.dstport=445.dstintf="To-DATALOG\_PPD".dstintfrole="undefined".srccountry="Reserved".dstcountry="Reserved".sessionid=2062428193.proto=6.action="deny".policyid=0.policytype="policy".service="SMB".trandisp="noop".duration=0.sentbyte=0.rcvdbyte=0.sentpkt=0.vpn="To-GCP".vpntype="ipsec-static".appcat="unscanned".crscore=30.craction=131072.crlevel="high"\n","eventCnt":"1","hasOffense":"false","domainID":"4","domainName":"Decathlon","eventName":"Firewall.Deny","lowLevelCategory":"Firewall.Deny","highLevelCategory":"Access","eventDescription":"Firewall.Deny","protocolName":"tcp","logSource":"FortiGate.@.192.168.0.3","srcNetName":"Net-10-172-192.Net\_10\_0\_0\_0","dstNetName":"Net-10-172-192.Net\_192\_168\_0\_0","logSourceType":"Fortinet.FortiGate.Security.Gateway","logSourceGroup":"Other","logSourceIdentifier":"192.168.0.3"}
What is the output from the `_cluster/stats?pretty&human` API?
which command should I use?
He can no longer load the kibana page to see the logs.
Below the capture
I have the output below, when I do the following command:
tail -f /var/log/logstash/logstash-plain.log
[2021-01-07T18:07:31,699][WARN][logstash.outputs.elasticsearchmonitoring][.monitoring-logstash] Restored connection to ES instance {:url=\>"[https://logstash\_system:xxxxxx@ELASTIC1:9200/](https://logstash_system:xxxxxx@ELASTIC1:9200/)"}
[2021-01-07T18:07:31,712][INFO][logstash.outputs.elasticsearchmonitoring][.monitoring-logstash] ES Output version determined {:es\_version=\>7}
[2021-01-07T18:07:31,714][WARN][logstash.outputs.elasticsearchmonitoring][.monitoring-logstash] Detected a 6.x and above cluster: the `type` event field won't be used to determine the document \_type {:es\_version=\>7}
[2021-01-07T18:07:31,757][WARN][logstash.outputs.elasticsearchmonitoring][.monitoring-logstash] Restored connection to ES instance {:url=\>"[https://logstash\_system:xxxxxx@ELASTIC2:9200/](https://logstash_system:xxxxxx@ELASTIC2:9200/)"}
[2021-01-07T18:07:31,782][INFO][logstash.outputs.elasticsearchmonitoring][.monitoring-logstash] New Elasticsearch output {:class=\>"LogStash::Outputs::ElasticSearchMonitoring", :hosts=\>["[https://ELASTIC1:9200](https://ELASTIC1:9200)", "[https://ELASTIC2:9200](https://ELASTIC2:9200)"]}
[2021-01-07T18:07:31,785][WARN][logstash.javapipeline][.monitoring-logstash] 'pipeline.ordered' is enabled and is likely less efficient, consider disabling if preserving event order is not necessary
[2021-01-07T18:07:31,790][INFO][logstash.javapipeline][.monitoring-logstash] Starting pipeline {:pipeline\_id=\>".monitoring-logstash", "pipeline.workers"=\>1, "pipeline.batch.size"=\>2, "pipeline.batch.delay"=\>50, "pipeline.max\_inflight"=\>2, "pipeline.sources"=\>["monitoring pipeline"], :thread=\>"#\"}
[2021-01-07T18:07:31,818][INFO][logstash.javapipeline][.monitoring-logstash] Pipeline started {"pipeline.id"=\>".monitoring-logstash"}
[2021-01-07T18:07:31,824][INFO][logstash.agent] Pipelines running {:count=\>2, :running\_pipelines=\>[:main, :".monitoring-logstash"], :non\_running\_pipelines=\>}
[2021-01-07T18:07:31,934][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600}
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [January 11, 2021, 4:46am UTC](https://discuss.elastic.co/t/logs-are-no-longer-sent-to-elasticsearch/260378/4 "2021-01-11T04:46:20Z")
What is the output from the `_cat/health?v` API in Elasticsearch?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 8, 2021, 4:46am UTC](https://discuss.elastic.co/t/logs-are-no-longer-sent-to-elasticsearch/260378/5 "2021-02-08T04:46:20Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.