# Logs are not displaying in order

**URL:** <https://discuss.elastic.co/t/logs-are-not-displaying-in-order/80409>\
**Category:** Logstash\
**Created:** [March 29, 2017, 5:58am UTC](https://discuss.elastic.co/t/logs-are-not-displaying-in-order/80409 "2017-03-29T05:58:00Z")\
**Posts on this page:** 11\
**Page:** 3

<div class="post-metadata">

**Author:** ![Raja1](https://avatars.discourse-cdn.com/v4/letter/r/85f322/32.png) [@Raja1](https://discuss.elastic.co/u/Raja1)\
**Post date:** [April 3, 2017, 5:23am UTC](https://discuss.elastic.co/t/logs-are-not-displaying-in-order/80409/41 "2017-04-03T05:23:45Z")

</div>

logstash 56599 1.2 6.1 3653792 498544 ? SNsl Mar29 85:44 /usr/bin/java -  
XX:+UseParNewGC -XX:+UseConcMarkSweepGC -XX:CMSInitiatingOccupancyFraction=75 -X  
X:+UseCMSInitiatingOccupancyOnly -XX:+DisableExplicitGC -Djava.awt.headless=true  
-Dfile.encoding=UTF-8 -XX:+HeapDumpOnOutOfMemoryError -Xmx1g -Xms256m -Xss2048k  
-Djffi.boot.library.path=/usr/share/logstash/vendor/jruby/lib/jni -Xbootclasspa  
th/a:/usr/share/logstash/vendor/jruby/lib/jruby.jar -classpath : -Djruby.home=/u  
sr/share/logstash/vendor/jruby -Djruby.lib=/usr/share/logstash/vendor/jruby/lib  
-Djruby.script=jruby -Djruby.shell=/bin/sh org.jruby.Main /usr/share/logstash/li  
b/bootstrap/environment.rb logstash/runner.rb --path.settings /etc/logstash  
elastic+ 61876 0.0 29.6 4792968 2421760 ? Ssl Mar29 7:00 /bin/java -Xms2  
g -Xmx2g -XX:+UseConcMarkSweepGC -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseC  
MSInitiatingOccupancyOnly -XX:+DisableExplicitGC -XX:+AlwaysPreTouch -server -Xs  
s1m -Djava.awt.headless=true -Dfile.encoding=UTF-8 -Djna.nosys=true -Djdk.io.per  
missionsUseCanonicalPath=true -Dio.netty.noUnsafe=true -Dio.netty.noKeySetOptimi  
zation=true -Dio.netty.recycler.maxCapacityPerThread=0 -Dlog4j.shutdownHookEnabl  
ed=false -Dlog4j2.disable.jmx=true -Dlog4j.skipJansi=true -XX:+HeapDumpOnOutOfMe  
moryError -Des.path.home=/usr/share/elasticsearch -cp /usr/share/elasticsearch/l  
ib/elasticsearch-5.2.2.jar:/usr/share/elasticsearch/lib/\* org.elasticsearch.boot  
strap.Elasticsearch -p /var/run/elasticsearch/elasticsearch.pid --quiet -Edefaul  
t.path.logs=/var/log/elasticsearch -Edefault.path.data=/var/lib/elasticsearch -E  
default.path.conf=/etc/elasticsearch

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 3, 2017, 5:37am UTC](https://discuss.elastic.co/t/logs-are-not-displaying-in-order/80409/42 "2017-04-03T05:37:32Z")

</div>

Okay, looks good so far. If you bump the log level to debug, Logstash will log all the configuration it loads. That might give clues about what's going on.

---

<div class="post-metadata">

**Author:** ![Raja1](https://avatars.discourse-cdn.com/v4/letter/r/85f322/32.png) [@Raja1](https://discuss.elastic.co/u/Raja1)\
**Post date:** [April 3, 2017, 5:42am UTC](https://discuss.elastic.co/t/logs-are-not-displaying-in-order/80409/43 "2017-04-03T05:42:50Z")

</div>

I am getting below after enabling debug.

[2017-04-03T03:04:14,939][INFO][logstash.outputs.elasticsearch] New Elasticsearch output {:class=\>"LogStash::Outputs::ElasticSearch", :hosts=\>[#\<URI::Generic:0x2e138a51 URL://localhost:9200\>]}  
[2017-04-03T03:04:15,127][INFO][logstash.pipeline] Starting pipeline {"id"=\>"main", "pipeline.workers"=\>2, "pipeline.batch.size"=\>125, "pipeline.batch.delay"=\>5, "pipeline.max\_inflight"=\>250}  
[2017-04-03T03:04:15,137][INFO][logstash.pipeline] Pipeline main started  
[2017-04-03T03:04:15,214][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600}  
[2017-04-03T05:40:18,421][WARN][logstash.runner] SIGTERM received. Shutting down the agent.  
[2017-04-03T05:40:19,082][WARN][logstash.agent] stopping pipeline {:id=\>"main"}  
[2017-04-03T05:40:26,913][WARN][logstash.shutdownwatcher] {"inflight\_count"=\>0, "stalling\_thread\_info"=\>{}}  
[2017-04-03T05:40:26,951][ERROR][logstash.shutdownwatcher] The shutdown process appears to be stalled due to busy or blocked plugins. Check the logs for more information.  
[2017-04-03T05:40:47,075][FATAL][logstash.runner] An unexpected error occurred! {:error=\>#\<ArgumentError: Setting "" hasn't been registered\>, :backtrace=\>["/opt/logstash/logstash-core/lib/logstash/settings.rb:29:in `get_setting'", "/opt/logstash/logstash-core/lib/logstash/settings.rb:61:in`set\_value'", "/opt/logstash/logstash-core/lib/logstash/settings.rb:80:in `merge'", "org/jruby/RubyHash.java:1342:in`each'", "/opt/logstash/logstash-core/lib/logstash/settings.rb:80:in `merge'", "/opt/logstash/logstash-core/lib/logstash/settings.rb:115:in`validate\_all'", "/opt/logstash/logstash-core/lib/logstash/runner.rb:210:in `execute'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/clamp-0.6.5/lib/clamp/command.rb:67:in`run'", "/opt/logstash/logstash-core/lib/logstash/runner.rb:183:in `run'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/clamp-0.6.5/lib/clamp/command.rb:132:in`run'", "/opt/logstash/lib/bootstrap/environment.rb:71:in `(root)'"]}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 3, 2017, 5:57am UTC](https://discuss.elastic.co/t/logs-are-not-displaying-in-order/80409/44 "2017-04-03T05:57:56Z")

</div>

If those are the only logs you get you didn't enable debug logging properly. All of those logs are info, warn, error, and fatal. Otherwise look further up in the log. Unless things have changed recently it should tell you exactly what configuration it loads and hopefully also from where.

---

<div class="post-metadata">

**Author:** ![Raja1](https://avatars.discourse-cdn.com/v4/letter/r/85f322/32.png) [@Raja1](https://discuss.elastic.co/u/Raja1)\
**Post date:** [April 3, 2017, 9:46am UTC](https://discuss.elastic.co/t/logs-are-not-displaying-in-order/80409/45 "2017-04-03T09:46:32Z")

</div>

log.level:debug

I have enabled the above property in logstash.yml file. Could you please let me know is there any other place to enable debug mode.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 3, 2017, 9:49am UTC](https://discuss.elastic.co/t/logs-are-not-displaying-in-order/80409/46 "2017-04-03T09:49:41Z")

</div>

Did you try with a space before "debug"?

```
log.level: debug
```

---

<div class="post-metadata">

**Author:** ![Raja1](https://avatars.discourse-cdn.com/v4/letter/r/85f322/32.png) [@Raja1](https://discuss.elastic.co/u/Raja1)\
**Post date:** [April 3, 2017, 9:50am UTC](https://discuss.elastic.co/t/logs-are-not-displaying-in-order/80409/47 "2017-04-03T09:50:10Z")

</div>

Yes. i tried

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 3, 2017, 9:53am UTC](https://discuss.elastic.co/t/logs-are-not-displaying-in-order/80409/48 "2017-04-03T09:53:06Z")

</div>

Hmm. If you despite that don't get any debug logs it might be an indication that Logstash is running with different startup options than you think, which could also explain why you're still getting an elasticsearch output even though you say you don't any such thing in your configuration. Exactly how are you starting Logstash?

---

<div class="post-metadata">

**Author:** ![Raja1](https://avatars.discourse-cdn.com/v4/letter/r/85f322/32.png) [@Raja1](https://discuss.elastic.co/u/Raja1)\
**Post date:** [April 3, 2017, 9:53am UTC](https://discuss.elastic.co/t/logs-are-not-displaying-in-order/80409/49 "2017-04-03T09:53:52Z")

</div>

service logstash start/stop/restart options

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 3, 2017, 9:54am UTC](https://discuss.elastic.co/t/logs-are-not-displaying-in-order/80409/50 "2017-04-03T09:54:50Z")

</div>

Hmm. Then I don't know what's going on here.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 1, 2017, 9:55am UTC](https://discuss.elastic.co/t/logs-are-not-displaying-in-order/80409/51 "2017-05-01T09:55:02Z")

</div>

Closed on May 1, 2017, 9:55am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

[Previous page](https://discuss.elastic.co/t/logs-are-not-displaying-in-order/80409.md?page=2)
