# Logstash does not output to elastic , and now does not work at all

**URL:** https://discuss.elastic.co/t/logstash-does-not-output-to-elastic-and-now-does-not-work-at-all/50912
**Category:** Logstash
**Created:** [May 25, 2016, 7:26am UTC](https://discuss.elastic.co/t/logstash-does-not-output-to-elastic-and-now-does-not-work-at-all/50912 "2016-05-25T07:26:02Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![gilisade](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gilisade/32/98740_2.png) [@gilisade](https://discuss.elastic.co/u/gilisade)
#### Post date: [May 25, 2016, 7:26am UTC](https://discuss.elastic.co/t/logstash-does-not-output-to-elastic-and-now-does-not-work-at-all/50912/1 "2016-05-25T07:26:02Z")

</div>

hi , i've benn dealing with a problem for 2 days now  
i'm using logstash 2.3 on rhel VM  
my logstash configurations worked just fine until yesterday:  
i built another very simple configuration :  
input {  
file {  
type =\> "authlog15"  
path =\> "/logstash/logs/auth2015-11-15-10.log"  
sincedb\_path =\> "/dev/null"  
start\_position =\> "beginning"  
codec =\> multiline {  
pattern =\> "^%{YEAR}"  
negate =\> "true"  
what =\> "next"

}  
}

}

filter {  
if [type] == "authlog15" {

```
            grok {

                    match => ["message", "%{GREEDYDATA:text}"]

```

}

}  
}

output {  
if [type] == "authlog15" {  
elasticsearch {  
hosts =\> ["hostname:9200"]  
index =\> "authlog"

}

}

tried to run it with /opt/logstash/bin/logstash -f config.conf --debug  
and i kept getting these messages with debug :

---

<div class="post-metadata">

### Author: ![gilisade](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gilisade/32/98740_2.png) [@gilisade](https://discuss.elastic.co/u/gilisade)
#### Post date: [May 25, 2016, 7:27am UTC](https://discuss.elastic.co/t/logstash-does-not-output-to-elastic-and-now-does-not-work-at-all/50912/2 "2016-05-25T07:27:47Z")

</div>

the same message kept coming up 3-4 times per second  
tried to run the configuration with the service (put it in /etc/logstash/conf.d)  
and the service crashed after 3 second (no logs - tried to run the service with debug and still no logs)  
now al the other configurations that have worked before don't work now - the service always crashes

tried to change LS\_HEAP\_SIZE -still didn't work  
tried booting the server twice - no help  
tried to reinstall logstash - no help

what to do ????

---

<div class="post-metadata">

### Author: ![gilisade](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gilisade/32/98740_2.png) [@gilisade](https://discuss.elastic.co/u/gilisade)
#### Post date: [May 25, 2016, 7:30am UTC](https://discuss.elastic.co/t/logstash-does-not-output-to-elastic-and-now-does-not-work-at-all/50912/3 "2016-05-25T07:30:43Z")

</div>

```
the message: 
Flushing buffer at interval {:instance=>"#<LogStash::Outputs::ElasticSearch::Buffer:0x26cf2d97 @operations_mutex=#<Mutex:0x2808c73e>, @max_size=500, @operations_lock=#<Java::JavaUtilConcurrentLocks::ReentrantLock:0x2c3746e7>, @submit_proc=#<Proc:0x3649f621@/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-2.6.2-java/lib/logstash/outputs/elasticsearch/common.rb:57>, @logger=#<Cabin::Channel:0x5816e6e1 @metrics=#<Cabin::Metrics:0x4e80837a @metrics_lock=#<Mutex:0x91a324a>, @metrics={}, @channel=#<Cabin::Channel:0x5816e6e1 ...>>, @subscriber_lock=#<Mutex:0x701b25b6>, @level=:debug, @subscribers={12378=>#<Cabin::Subscriber:0x55842f79 @output=#<Cabin::Outputs::IO:0xd54cfe1 @io=#<IO:fd 1>, @lock=#<Mutex:0x24cb6d68>>, @options={}>}, @data={}>, @last_flush=2016-05-25 10:21:21 +0300, @flush_interval=1, @stopping=#<Concurrent::AtomicBoolean:0x140b3d7f>, @buffer=[], @flush_thread=#<Thread:0x60802760 run>>", :interval=>1, :level=>:debug, :file=>"logstash/outputs/elasticsearch/buffer.rb", :line=>"90", :method=>"interval_flush"}`indent preformatted text by 4 spaces`
```

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [May 25, 2016, 9:16am UTC](https://discuss.elastic.co/t/logstash-does-not-output-to-elastic-and-now-does-not-work-at-all/50912/4 "2016-05-25T09:16:55Z")

</div>

Is ES up and running?

---

<div class="post-metadata">

### Author: ![gilisade](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gilisade/32/98740_2.png) [@gilisade](https://discuss.elastic.co/u/gilisade)
#### Post date: [July 6, 2016, 1:09pm UTC](https://discuss.elastic.co/t/logstash-does-not-output-to-elastic-and-now-does-not-work-at-all/50912/5 "2016-07-06T13:09:22Z")

</div>

The problem was that i needed to put the ignore\_older for more thanks 24h

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:49am UTC](https://discuss.elastic.co/t/logstash-does-not-output-to-elastic-and-now-does-not-work-at-all/50912/7 "2017-07-06T04:49:09Z")

</div>


