# Logs Strucked at Redis or Logstash

**URL:** <https://discuss.elastic.co/t/logs-strucked-at-redis-or-logstash/40876>\
**Category:** Logstash\
**Created:** [February 3, 2016, 3:01pm UTC](https://discuss.elastic.co/t/logs-strucked-at-redis-or-logstash/40876 "2016-02-03T15:01:01Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![praveen\_siem](https://avatars.discourse-cdn.com/v4/letter/p/e9a140/32.png) [@praveen\_siem](https://discuss.elastic.co/u/praveen_siem)\
**Post date:** [February 3, 2016, 3:01pm UTC](https://discuss.elastic.co/t/logs-strucked-at-redis-or-logstash/40876/1 "2016-02-03T15:01:01Z")

</div>

Dear Folks,

We are faced with a issue, were in we are monitoring data from firewall, syslog and others. The data is coming from logstash (Shipper) to logstash (Indexer) and being forwarded to elastic search.

We are able to collect the data from firewall etc, but not able to collect for syslog, what could be the possible reason for this.

Please suggest.

Regards-  
Praveen K

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 3, 2016, 3:42pm UTC](https://discuss.elastic.co/t/logs-strucked-at-redis-or-logstash/40876/2 "2016-02-03T15:42:59Z")

</div>

How is the syslog collection done? Is Logstash receiving messages over the network or reading messages from e.g. /var/log/syslog?

---

<div class="post-metadata">

**Author:** ![praveen\_siem](https://avatars.discourse-cdn.com/v4/letter/p/e9a140/32.png) [@praveen\_siem](https://discuss.elastic.co/u/praveen_siem)\
**Post date:** [February 3, 2016, 3:43pm UTC](https://discuss.elastic.co/t/logs-strucked-at-redis-or-logstash/40876/3 "2016-02-03T15:43:36Z")

</div>

Reading messages over /var/log/syslog

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 3, 2016, 3:55pm UTC](https://discuss.elastic.co/t/logs-strucked-at-redis-or-logstash/40876/4 "2016-02-03T15:55:44Z")

</div>

Does the Logstash process have permission to read that file? If you start Logstash with `--verbose` it'll complain about permission problems.

---

<div class="post-metadata">

**Author:** ![praveen\_siem](https://avatars.discourse-cdn.com/v4/letter/p/e9a140/32.png) [@praveen\_siem](https://discuss.elastic.co/u/praveen_siem)\
**Post date:** [February 3, 2016, 5:00pm UTC](https://discuss.elastic.co/t/logs-strucked-at-redis-or-logstash/40876/5 "2016-02-03T17:00:40Z")

</div>

Actually to clear , it is both i mean network and syslog...Logstash (Shipper) located at client sites logs are being collected here (from devices) and forwarded to Logstash (indexer) through redis (messaging queue) .

Messages/logs are coming till messaging queue / Indexer and getting strucked for syslog only and not for firewall and other....can't understand where id the deadlock.?

---

<div class="post-metadata">

**Author:** ![praveen\_siem](https://avatars.discourse-cdn.com/v4/letter/p/e9a140/32.png) [@praveen\_siem](https://discuss.elastic.co/u/praveen_siem)\
**Post date:** [February 17, 2016, 10:25am UTC](https://discuss.elastic.co/t/logs-strucked-at-redis-or-logstash/40876/6 "2016-02-17T10:25:55Z")

</div>

Thanks. this issues got resolved.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:11am UTC](https://discuss.elastic.co/t/logs-strucked-at-redis-or-logstash/40876/7 "2017-07-06T05:11:03Z")

</div>

Closed on July 6, 2017, 5:11am UTC