# Logstash doesnt send logs to elasticsearch OR filebeat doesnt send logs to logstash

**URL:** <https://discuss.elastic.co/t/logstash-doesnt-send-logs-to-elasticsearch-or-filebeat-doesnt-send-logs-to-logstash/365931>\
**Category:** Logstash\
**Created:** [September 3, 2024, 7:36am UTC](https://discuss.elastic.co/t/logstash-doesnt-send-logs-to-elasticsearch-or-filebeat-doesnt-send-logs-to-logstash/365931 "2024-09-03T07:36:42Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![jakub0011](https://avatars.discourse-cdn.com/v4/letter/j/b4bc9f/32.png) [@jakub0011](https://discuss.elastic.co/u/jakub0011)\
**Post date:** [September 3, 2024, 7:36am UTC](https://discuss.elastic.co/t/logstash-doesnt-send-logs-to-elasticsearch-or-filebeat-doesnt-send-logs-to-logstash/365931/1 "2024-09-03T07:36:42Z")

</div>

Hi, i have elasticsearch cluster with:

logstash 7.17.18  
kibana 7.17.18  
elasticsearch 7.17.18  
filebeat 7.10

Everything worked fine for a month, but for the past 2 days not all logs are being sent to Elasticsearch from Logstash

Logstash has 6GB of RAM allocated in jvm.options (xmx, xms)

Sometimes the systemctl restart logstash command takes a very long time to complete, sometimes after restarting logstash there is a larger influx of logs, but only for a moment.

Generally, I have the impression that every third message is being sent to elasticsearch.

I Have this log in elasticsearch.log always:  
Can U help me?

```sh
[2024-09-03T09:34:06,296][WARN][o.e.h.AbstractHttpServerTransport] [hostname.blabla] caught exception while handling client http traffic, closing connection Netty4HttpChannel{localAddress=/10.25.32.111:9200, remoteAddress=/10.24.32.53:55744}
io.netty.handler.codec.PrematureChannelClosureException: Channel closed while still aggregating message
        at io.netty.handler.codec.MessageAggregator.channelInactive(MessageAggregator.java:436) [netty-codec-4.1.94.Final.jar:4.1.94.Final]
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelInactive(AbstractChannelHandlerContext.java:305) [netty-transport-4.1.94.Final.jar:4.1.94.Final]
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelInactive(AbstractChannelHandlerContext.java:281) [netty-transport-4.1.94.Final.jar:4.1.94.Final]
        at io.netty.channel.AbstractChannelHandlerContext.fireChannelInactive(AbstractChannelHandlerContext.java:274) [netty-transport-4.1.94.Final.jar:4.1.94.Final]
        at io.netty.channel.ChannelInboundHandlerAdapter.channelInactive(ChannelInboundHandlerAdapter.java:81) [netty-transport-4.1.94.Final.jar:4.1.94.Final]
        at io.netty.handler.codec.http.HttpContentDecoder.channelInactive(HttpContentDecoder.java:235) [netty-codec-http-4.1.94.Final.jar:4.1.94.Final]
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelInactive(AbstractChannelHandlerContext.java:305) [netty-transport-4.1.94.Final.jar:4.1.94.Final]
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelInactive(AbstractChannelHandlerContext.java:281) [netty-transport-4.1.94.Final.jar:4.1.94.Final]
        at io.netty.channel.AbstractChannelHandlerContext.fireChannelInactive(AbstractChannelHandlerContext.java:274) [netty-transport-4.1.94.Final.jar:4.1.94.Final]
        at io.netty.channel.ChannelInboundHandlerAdapter.channelInactive(ChannelInboundHandlerAdapter.java:81) [netty-transport-4.1.94.Final.jar:4.1.94.Final]
        at org.elasticsearch.http.netty4.Netty4HttpHeaderValidator.channelInactive(Netty4HttpHeaderValidator.java:186) [transport-netty4-client-7.17.18.jar:7.17.18]
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelInactive(AbstractChannelHandlerContext.java:305) [netty-transport-4.1.94.Final.jar:4.1.94.Final]
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelInactive(AbstractChannelHandlerContext.java:281) [netty-transport-4.1.94.Final.jar:4.1.94.Final]
        at io.netty.channel.AbstractChannelHandlerContext.fireChannelInactive(AbstractChannelHandlerContext.java:274) [netty-transport-4.1.94.Final.jar:4.1.94.Final]
        at io.netty.handler.codec.ByteToMessageDecoder.channelInputClosed(ByteToMessageDecoder.java:411) [netty-codec-4.1.94.Final.jar:4.1.94.Final]
        at io.netty.handler.codec.ByteToMessageDecoder.channelInactive(ByteToMessageDecoder.java:376) [netty-codec-4.1.94.Final.jar:4.1.94.Final]
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelInactive(AbstractChannelHandlerContext.java:305) [netty-transport-4.1.94.Final.jar:4.1.94.Final]
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelInactive(AbstractChannelHandlerContext.java:281) [netty-transport-4.1.94.Final.jar:4.1.94.Final]
        at io.netty.channel.AbstractChannelHandlerContext.fireChannelInactive(AbstractChannelHandlerContext.java:274) [netty-transport-4.1.94.Final.jar:4.1.94.Final]
        at io.netty.channel.ChannelInboundHandlerAdapter.channelInactive(ChannelInboundHandlerAdapter.java:81) [netty-transport-4.1.94.Final.jar:4.1.94.Final]
        at io.netty.handler.timeout.IdleStateHandler.channelInactive(IdleStateHandler.java:277) [netty-handler-4.1.94.Final.jar:4.1.94.Final]
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelInactive(AbstractChannelHandlerContext.java:303) [netty-transport-4.1.94.Final.jar:4.1.94.Final]
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelInactive(AbstractChannelHandlerContext.java:281) [netty-transport-4.1.94.Final.jar:4.1.94.Final]
        at io.netty.channel.AbstractChannelHandlerContext.fireChannelInactive(AbstractChannelHandlerContext.java:274) [netty-transport-4.1.94.Final.jar:4.1.94.Final]
        at io.netty.channel.DefaultChannelPipeline$HeadContext.channelInactive(DefaultChannelPipeline.java:1405) [netty-transport-4.1.94.Final.jar:4.1.94.Final]
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelInactive(AbstractChannelHandlerContext.java:301) [netty-transport-4.1.94.Final.jar:4.1.94.Final]
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelInactive(AbstractChannelHandlerContext.java:281) [netty-transport-4.1.94.Final.jar:4.1.94.Final]
        at io.netty.channel.DefaultChannelPipeline.fireChannelInactive(DefaultChannelPipeline.java:901) [netty-transport-4.1.94.Final.jar:4.1.94.Final]
        at io.netty.channel.AbstractChannel$AbstractUnsafe$7.run(AbstractChannel.java:813) [netty-transport-4.1.94.Final.jar:4.1.94.Final]
        at io.netty.util.concurrent.AbstractEventExecutor.runTask(AbstractEventExecutor.java:174) [netty-common-4.1.94.Final.jar:4.1.94.Final]
        at io.netty.util.concurrent.AbstractEventExecutor.safeExecute(AbstractEventExecutor.java:167) [netty-common-4.1.94.Final.jar:4.1.94.Final]
        at io.netty.util.concurrent.SingleThreadEventExecutor.runAllTasks(SingleThreadEventExecutor.java:470) [netty-common-4.1.94.Final.jar:4.1.94.Final]
        at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:566) [netty-transport-4.1.94.Final.jar:4.1.94.Final]
        at io.netty.util.concurrent.SingleThreadEventExecutor$4.run(SingleThreadEventExecutor.java:997) [netty-common-4.1.94.Final.jar:4.1.94.Final]
        at io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74) [netty-common-4.1.94.Final.jar:4.1.94.Final]
        at java.lang.Thread.run(Thread.java:1583) [?:?]

```

---

<div class="post-metadata">

**Author:** ![jakub0011](https://avatars.discourse-cdn.com/v4/letter/j/b4bc9f/32.png) [@jakub0011](https://discuss.elastic.co/u/jakub0011)\
**Post date:** [September 3, 2024, 9:37am UTC](https://discuss.elastic.co/t/logstash-doesnt-send-logs-to-elasticsearch-or-filebeat-doesnt-send-logs-to-logstash/365931/2 "2024-09-03T09:37:58Z")

</div>

Solution is  
systemctl stop ds\_agent (anty-virus)