# Logstash 6.5.0 stops shipping logs to ES

**URL:** <https://discuss.elastic.co/t/logstash-6-5-0-stops-shipping-logs-to-es/175477>\
**Category:** Logstash\
**Created:** [April 4, 2019, 7:15pm UTC](https://discuss.elastic.co/t/logstash-6-5-0-stops-shipping-logs-to-es/175477 "2019-04-04T19:15:38Z")\
**Posts on this page:** 4\
**Page:** 2

<div class="post-metadata">

**Author:** ![guyboertje](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/guyboertje/32/31592_2.png) [@guyboertje](https://discuss.elastic.co/u/guyboertje)\
**Post date:** [April 16, 2019, 8:53pm UTC](https://discuss.elastic.co/t/logstash-6-5-0-stops-shipping-logs-to-es/175477/21 "2019-04-16T20:53:58Z")

</div>

The file input will track the "movement" of rotated content through file renames **if** the rotated filenames can be discovered, i.e. they are inside the glob pattern - it is more tested on \*nix than Windows.

You can/should edit the glob to include the rotated patterns during the restart, perhaps.

---

<div class="post-metadata">

**Author:** ![stash2logs](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stash2logs/32/42101_2.png) [@stash2logs](https://discuss.elastic.co/u/stash2logs)\
**Post date:** [April 19, 2019, 6:24pm UTC](https://discuss.elastic.co/t/logstash-6-5-0-stops-shipping-logs-to-es/175477/22 "2019-04-19T18:24:28Z")

</div>

@guyboertje, One other piece of information that I would like to add to the thread, but not sure if it will help. After 5 days of not receiving any logs we noticed that logs started appearing in ES again. We went and looked that the logstash logs on the server1 and server2 and we can see that server1 is processing the logs.

It seems to be that logstash was stuck somewhere processing the logs. Once again there is not much information in the logs.

Note: we did not restart logstash or restart the server. There seems to be something strange here.

I also want to point out that the output of the CPU percentage use by logstash looks very high:

| process | |
| --- | --- |
| open\_file\_descriptors | 101 |
| peak\_open\_file\_descriptors | 105 |
| max\_file\_descriptors | 4096 |
| mem | |
| total\_virtual\_in\_bytes | 4941590528 |
| cpu | |
| total\_in\_millis | 1387457270 |
| percent | 100 |
| load\_average | |
| 1m | 6.18 |
| 5m | 6.44 |
| 15m | 6.57 |

---

<div class="post-metadata">

**Author:** ![stash2logs](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stash2logs/32/42101_2.png) [@stash2logs](https://discuss.elastic.co/u/stash2logs)\
**Post date:** [April 27, 2019, 2:15pm UTC](https://discuss.elastic.co/t/logstash-6-5-0-stops-shipping-logs-to-es/175477/23 "2019-04-27T14:15:07Z")

</div>

Anyone has more suggestions to provide here. Our logstash process CPU percent is at 100 and logstash stop processing events. Has anyone seen this behavior?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 25, 2019, 2:15pm UTC](https://discuss.elastic.co/t/logstash-6-5-0-stops-shipping-logs-to-es/175477/24 "2019-05-25T14:15:10Z")

</div>

Closed on May 25, 2019, 2:15pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

[Previous page](https://discuss.elastic.co/t/logstash-6-5-0-stops-shipping-logs-to-es/175477.md?page=1)