# Logstash: ^CSIGINT received. Shutting down the pipeline. {:level=\>:warn} **URL:** \ **Category:** Logstash\ **Created:** [March 4, 2016, 10:10am UTC](https://discuss.elastic.co/t/logstash-csigint-received-shutting-down-the-pipeline-level-warn/43497 "2016-03-04T10:10:31Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Shobhlika](https://avatars.discourse-cdn.com/v4/letter/s/e5b9ba/32.png) [@Shobhlika](https://discuss.elastic.co/u/Shobhlika)\ **Post date:** [March 4, 2016, 10:10am UTC](https://discuss.elastic.co/t/logstash-csigint-received-shutting-down-the-pipeline-level-warn/43497/1 "2016-03-04T10:10:31Z")
./logstash -f weblogic-config You are using a deprecated config setting "pattern" set in grok. Deprecated sett ings will continue to work, but are scheduled for removal from logstash in the f uture. You should use this instead: match =\> { "message" =\> "your pattern here" } If you have any questions about this, please visit the #logstash channel on fr eenode irc. {:name=\>"pattern", :plugin=\>\, :level=\>: warn} Logstash startup completed ^CSIGINT received. Shutting down the pipeline. {:level=\>:warn} ^CSIGINT received. Shutting down the pipeline. {:level=\>:warn} ^CSIGINT received. Shutting down the pipeline. {:level=\>:warn} Killed ELK was working fine until now, but from last some days, it giving a lot of trouble. There is nothing that gets shown in Kibana. Any suggestions to troubleshoot or resolve this. logstash-1.5.0 kibana-4.0.2 elasticsearch-1.5.1 Regards, Shobhlika ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [March 4, 2016, 10:35am UTC](https://discuss.elastic.co/t/logstash-csigint-received-shutting-down-the-pipeline-level-warn/43497/2 "2016-03-04T10:35:58Z")
Showing your configuration would be a good start. ---
**Author:** ![Shobhlika](https://avatars.discourse-cdn.com/v4/letter/s/e5b9ba/32.png) [@Shobhlika](https://discuss.elastic.co/u/Shobhlika)\ **Post date:** [March 4, 2016, 11:33am UTC](https://discuss.elastic.co/t/logstash-csigint-received-shutting-down-the-pipeline-level-warn/43497/3 "2016-03-04T11:33:55Z")
Hello Magnus, Thank you for replying. This is the config file. input { file { type =\> "PRD-SOA01-OutFile" add\_field =\> { server =\> "PRD-SOA01" } path=\> "/u01/SOA\_PRD/logs/domain\_SOA\_PRD01/server\_soa\_PRD01/server\_soa\_PRD01.out" # codec =\> plain { charset =\> "ISO-8859-1" } } file { type =\> "PRD-SOA02-OutFile" add\_field =\> { server =\> "PRD-SOA02" } path=\> "/u01/SOA\_PRD/logs/domain\_SOA\_PRD01/server\_soa\_PRD02/server\_soa\_PRD02.out" # codec =\> plain { charset =\> "ISO-8859-1" } } file { type =\> "PRD-SOA03-OutFile" add\_field =\> { server =\> "PRD-SOA03" } path=\> "/u01/SOA\_PRD/logs/domain\_SOA\_PRD01/server\_soa\_PRD03/server\_soa\_PRD03.out" # codec =\> plain { charset =\> "ISO-8859-1" } } file { type =\> "PRD-SOA04-OutFile" add\_field =\> { server =\> "PRD-SOA04" } path=\> "/u01/SOA\_PRD/logs/domain\_SOA\_PRD01/server\_soa\_PRD04/server\_soa\_PRD04.out" # codec =\> plain { charset =\> "ISO-8859-1" } } file { type =\> "PRD-SOA05-OutFile" add\_field =\> { server =\> "PRD-SOA05" } path=\> "/u01/SOA\_PRD/logs/domain\_SOA\_PRD01/server\_soa\_PRD05/server\_soa\_PRD05.out" # codec =\> plain { charset =\> "ISO-8859-1" } } file { type =\> "PRD-SOA06-OutFile" add\_field =\> { server =\> "PRD-SOA06" } path=\> "/u01/SOA\_PRD/logs/domain\_SOA\_PRD01/server\_soa\_PRD06/server\_soa\_PRD06.out" # codec =\> plain { charset =\> "ISO-8859-1" } } } filter { multiline { pattern =\> "^\<%{MONTH} %{MONTHDAY}, %{YEAR} %{TIME} (?:AM|PM) (CEST)\>" what =\> "previous" negate =\>"true" } grok { pattern =\> "(?m)\<%{DATA:wls\_timestamp}\> \<%{DATA:severity}\> \<%{DATA:wls\_engine}\> \<%{DATA:wls\_errorcode}\> \<%{GREEDYDATA:wls\_logmessage}\>" } mutate { remove\_tag =\> ["multiline"] } if "Error" in [severity] { if "oracle.soa.b2b.transport" in [wls\_engine] { if "zero byte" in [wls\_logmessage] { mutate { add\_tag =\> ["Technical Error" , "0 KB File"] } } } } if "Error" in [severity] { if "oracle.soa.adapter" in [wls\_engine] { if "JCA-11438" in [wls\_logmessage] { mutate { add\_tag =\> ["Technical Error" , "FTP Error"] add\_field =\> {NOTE =\> "Error in establishing connection to FTP server"} } } } } if "Error" in [severity] { if "oracle.webservice.service" in [wls\_engine] { if "OWS" in [wls\_errorcode] { if "Transaction Rolledback" in [wls\_logmessage] { mutate { add\_tag =\> ["Technical Error" , "TimeOutException"] add\_field =\> { NOTE =\> "Transaction timed out after 590 seconds"} } } } } } } output { elasticsearch { host =\> "xx.xx.xxx.xx" index =\> "soaprd-%{+YYYY.MM.dd}" protocol=\>"http" port =\> "9200" } } ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [March 4, 2016, 12:06pm UTC](https://discuss.elastic.co/t/logstash-csigint-received-shutting-down-the-pipeline-level-warn/43497/4 "2016-03-04T12:06:20Z")
Oh, that's a lot. It's impossible to make a specific guess at what's wrong. I'd try starting Logstash with `--verbose` and looking in the logs for clues. For example, maybe the Logstash user no longer has access to the log files. I assume the log files are at least changing and getting more data appended to them? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 5:08am UTC](https://discuss.elastic.co/t/logstash-csigint-received-shutting-down-the-pipeline-level-warn/43497/5 "2017-07-06T05:08:22Z")
Closed on July 6, 2017, 5:08am UTC