# Logs generated while logstash stopped weren't collected after restart **URL:** \ **Category:** Logstash\ **Created:** [June 7, 2017, 2:19am UTC](https://discuss.elastic.co/t/logs-generated-while-logstash-stopped-werent-collected-after-restart/88493 "2017-06-07T02:19:37Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![rkj](https://avatars.discourse-cdn.com/v4/letter/r/a3d4f5/32.png) [@rkj](https://discuss.elastic.co/u/rkj)\ **Post date:** [June 7, 2017, 2:19am UTC](https://discuss.elastic.co/t/logs-generated-while-logstash-stopped-werent-collected-after-restart/88493/1 "2017-06-07T02:19:37Z")
Hi, Im using ELK and filebeat to collect and analise logs on a server. The problem i had was that I stopped logstash for a few hours and started it again but it seems that the logs during that period were not collected by logstash after restarting it. So, is filebeat still pushing logs to logstash even if logstash is not working and filebeat wont push that logs again once logstash starts running? Thank you. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [June 11, 2017, 2:37pm UTC](https://discuss.elastic.co/t/logs-generated-while-logstash-stopped-werent-collected-after-restart/88493/2 "2017-06-11T14:37:13Z")
Filebeat should pause while Logstash is down and send the logs when Logstash comes up again. Did the log files rotate during the Logstash outage? Is there anything interesting in the Filebeat logfile? ---
**Author:** ![rkj](https://avatars.discourse-cdn.com/v4/letter/r/a3d4f5/32.png) [@rkj](https://discuss.elastic.co/u/rkj)\ **Post date:** [June 12, 2017, 4:17am UTC](https://discuss.elastic.co/t/logs-generated-while-logstash-stopped-werent-collected-after-restart/88493/3 "2017-06-12T04:17:21Z")
> Did the log files rotate during the Logstash outage? Log files rotated before the outage so all logs that were supposed to be collected are in the same log file. > Is there anything interesting in the Filebeat logfile? Not really. It seems that filebeat was still publishing logs while logstash was not running. The cause of the Logstash's outage is that I changed the user's password on Kibana GUI but forgot to apply that change to logstash.conf so the authentication error occurred in the pipeline. Does this information help? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [June 12, 2017, 6:04am UTC](https://discuss.elastic.co/t/logs-generated-while-logstash-stopped-werent-collected-after-restart/88493/4 "2017-06-12T06:04:38Z")
Judging by [https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#\_retry\_policy](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#_retry_policy) authentications problems aren't retried indefinitely so I'd expect such configuration problems to result in data loss. ---
**Author:** ![rkj](https://avatars.discourse-cdn.com/v4/letter/r/a3d4f5/32.png) [@rkj](https://discuss.elastic.co/u/rkj)\ **Post date:** [June 12, 2017, 6:23am UTC](https://discuss.elastic.co/t/logs-generated-while-logstash-stopped-werent-collected-after-restart/88493/5 "2017-06-12T06:23:53Z")
I see. So, the pipeline between filebeat and logstash was okay and logstash received logs, but failed to connect to elasticsearch and didnt retry to send logs because of the retry policy, then logs were lost. Is that correct? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [June 12, 2017, 8:02am UTC](https://discuss.elastic.co/t/logs-generated-while-logstash-stopped-werent-collected-after-restart/88493/6 "2017-06-12T08:02:46Z")
Yes, I think that's what happened here. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 10, 2017, 8:03am UTC](https://discuss.elastic.co/t/logs-generated-while-logstash-stopped-werent-collected-after-restart/88493/7 "2017-07-10T08:03:25Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.