# Logstash error and MetricBeat stopped
**URL:** https://discuss.elastic.co/t/logstash-error-and-metricbeat-stopped/276398
**Category:** Logstash
**Created:** [June 18, 2021, 2:47pm UTC](https://discuss.elastic.co/t/logstash-error-and-metricbeat-stopped/276398 "2021-06-18T14:47:18Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@MKirby](https://discuss.elastic.co/u/MKirby)
#### Post date: [June 18, 2021, 2:47pm UTC](https://discuss.elastic.co/t/logstash-error-and-metricbeat-stopped/276398/1 "2021-06-18T14:47:18Z")
I noticed yesterday that my Metricbeat service had stopped running on the Windows test box I have. When I start Logstash I receive the below information.
[2021-06-18T10:28:12,009][WARN][logstash.outputs.elasticsearch][main][6d1545737824a8dbf91a10409724d61c6b8801e5bb7ba7c85d905a3ade6ef5f3] Could not index event to Elasticsearch. {:status=\>400, :action=\>["index", {:\_id=\>nil, :\_index=\>"winlogbeat-7.13.0-2021.06.18", :routing=\>nil}, #LogStash::Event:0x18c4a449], :response=\>{"index"=\>{"\_index"=\>"winlogbeat-7.13.0-2021.06.18", "\_type"=\>"\_doc", "\_id"=\>nil, "status"=\>400, "error"=\>{"type"=\>"validation\_exception", "reason"=\>"Validation Failed: 1: this action would add [2] total shards, but this cluster currently has [1000]/[1000] maximum shards open;"}}}}
In my startup of Kibana I receive the following:
at IncomingMessage.emit (events.js:327:22)
at endReadableNT (internal/streams/readable.js:1327:12)
at processTicksAndRejections (internal/process/task\_queues.js:80:21)
log [10:34:06.171] [warning][kibana-monitoring][monitoring][monitoring][plugins] Unable to bulk upload the stats payload to the local cluster
log [10:34:16.158] [warning][kibana-monitoring][monitoring][monitoring][plugins] ResponseError: export\_exception
at onBody (D:\ELK\kibana-7.12.1-windows-x86\_64\node\_modules@elastic\elasticsearch\lib\Transport.js:337:23)
at IncomingMessage.onEnd (D:\ELK\kibana-7.12.1-windows-x86\_64\node\_modules@elastic\elasticsearch\lib\Transport.js:264:11)
at IncomingMessage.emit (events.js:327:22)
at endReadableNT (internal/streams/readable.js:1327:12)
at processTicksAndRejections (internal/process/task\_queues.js:80:21)
log [10:34:16.159] [warning][kibana-monitoring][monitoring][monitoring][plugins] Unable to bulk upload the stats payload to the local cluster
And in ElasticSearch I get:
at org.elasticsearch.action.support.ContextPreservingActionListener.onResponse(ContextPreservingActionListener.java:32) [elasticsearch-7.12.1.jar:7.12.1]
at org.elasticsearch.xpack.security.action.filter.SecurityActionFilter.lambda$applyInternal$2(SecurityActionFilter.java:165) [x-pack-security-7.12.1.jar:7.12.1]
at org.elasticsearch.action.ActionListener$3.onResponse(ActionListener.java:167) [elasticsearch-7.12.1.jar:7.12.1]
at org.elasticsearch.action.ActionListener$5.onResponse(ActionListener.java:286) [elasticsearch-7.12.1.jar:7.12.1]
at org.elasticsearch.action.ActionListener$MappedActionListener.onResponse(ActionListener.java:76) [elasticsearch-7.12.1.jar:7.12.1]
at org.elasticsearch.action.ActionListener$1.onResponse(ActionListener.java:117) [elasticsearch-7.12.1.jar:7.12.1]
at org.elasticsearch.action.bulk.TransportBulkAction$BulkOperation.doRun(TransportBulkAction.java:498) [elasticsearch-7.12.1.jar:7.12.1]
at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:26) [elasticsearch-7.12.1.jar:7.12.1]
at org.elasticsearch.action.bulk.TransportBulkAction.executeBulk(TransportBulkAction.java:644) [elasticsearch-7.12.1.jar:7.12.1]
at org.elasticsearch.action.bulk.TransportBulkAction$1$2.doRun(TransportBulkAction.java:282) [elasticsearch-7.12.1.jar:7.12.1]
at org.elasticsearch.common.util.concurrent.ThreadContext$ContextPreservingAbstractRunnable.doRun(ThreadContext.java:732) [elasticsearch-7.12.1.jar:7.12.1]
at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:26) [elasticsearch-7.12.1.jar:7.12.1]
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1130) [?:?]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:630) [?:?]
at java.lang.Thread.run(Thread.java:831) [?:?]
Caused by: org.elasticsearch.xpack.monitoring.exporter.ExportException: bulk [default\_local] reports failures when exporting documents
at org.elasticsearch.xpack.monitoring.exporter.local.LocalBulk.throwExportException(LocalBulk.java:122) ~[?:?]
... 20 more
I have copied over a fresh version of both the Kibana.yml and EalsticSearch.yml files and receive the same messages, I am unable to start the metricbeat service as it times out. I have made no changes to my configuration over the past two weeks as I have been working on locating information only.
Also when I open a PowerShell and try to run a .\metricbeat test config I get an error on line 98, did not find expected key; which is a blank line in my configuration. See below metricbeat config file.
Should I try a fresh metricbeat.yml file?
---
### Author:  [@MKirby](https://discuss.elastic.co/u/MKirby)
#### Post date: [June 22, 2021, 4:49pm UTC](https://discuss.elastic.co/t/logstash-error-and-metricbeat-stopped/276398/2 "2021-06-22T16:49:15Z")
I continued researching and found that it was a spacing error in the metricbeat configuration yaml file and there is still some issue with the filebeat yaml file. The metricbeat is working again, although I had to delete some indices in order to get it functioning again. It appears that I did not have enough shards, and maxed out the 1000 available.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 20, 2021, 4:50pm UTC](https://discuss.elastic.co/t/logstash-error-and-metricbeat-stopped/276398/3 "2021-07-20T16:50:09Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.