# Logstash ES plugin occasionally can't reach server

**URL:** <https://discuss.elastic.co/t/logstash-es-plugin-occasionally-cant-reach-server/34055>\
**Category:** Logstash\
**Created:** [November 6, 2015, 8:56pm UTC](https://discuss.elastic.co/t/logstash-es-plugin-occasionally-cant-reach-server/34055 "2015-11-06T20:56:50Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![rsteckler](https://avatars.discourse-cdn.com/v4/letter/r/e495f1/32.png) [@rsteckler](https://discuss.elastic.co/u/rsteckler)\
**Post date:** [November 6, 2015, 8:56pm UTC](https://discuss.elastic.co/t/logstash-es-plugin-occasionally-cant-reach-server/34055/1 "2015-11-06T20:56:50Z")

</div>

I'm using Logsene as a hosted ELK provider. I log directly to logsene from Node.js using winston-logsene and I tail some logs to them via Logstash.

The node.js integration works perfectly. The problem is that the logstash integration drops maybe 5% of log lines.

Here's what I know:

1. If I add a file output next to the ES output, all of the messages show up in the file correctly.

2. The ES plugin puts the following in the logstash.log:

3. If I try to resend the failed message (by pulling it out of the file output, and curling it over to logsene), that manual retry works perfectly and the log line shows up correctly in Kibana.

4. I've _never_ seen a failure by curling line logs manually over to logsene. I've only ever seen the failure when the ES plugin tries to send the messages.

5. Increasing the ES plugin max\_retries and retry\_max\_interval doesn't seem to impact the failure rate, interestingly.

This all leads me to believe it's not a networking problem, despite the error message. It's not a data issue because a retry works. I'm not sure where to go from here.

Thanks for any advice on troubleshooting further.

Ryan

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 7, 2015, 12:39pm UTC](https://discuss.elastic.co/t/logstash-es-plugin-occasionally-cant-reach-server/34055/2 "2015-11-07T12:39:46Z")

</div>

Does Logstash recover automatically after a while, i.e. could it be a temporary glitch? A connection problem shouldn't cause messages to get dropped, it should stall the pipeline.

You're not the only one reporting this error since Logstash 2.0 was released.

---

<div class="post-metadata">

**Author:** ![rsteckler](https://avatars.discourse-cdn.com/v4/letter/r/e495f1/32.png) [@rsteckler](https://discuss.elastic.co/u/rsteckler)\
**Post date:** [November 7, 2015, 4:45pm UTC](https://discuss.elastic.co/t/logstash-es-plugin-occasionally-cant-reach-server/34055/3 "2015-11-07T16:45:39Z")

</div>

Logstash continues to run perfectly. It just drops one or two messages,  
and everything else works. It's only "down" for a fraction of a second.  
I've also don't think it's retrying the message. When I append a line to  
the log file, there exception shows up immediately. I would expect it to  
wait at least 15 second before failing in network communications because of  
the 3 retries at a 5 second interval.

Sounds like it may not just be me. If you need any debugging help, please  
let me know.

Thanks,  
Ryan

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:23am UTC](https://discuss.elastic.co/t/logstash-es-plugin-occasionally-cant-reach-server/34055/4 "2017-07-06T05:23:31Z")

</div>

Closed on July 6, 2017, 5:23am UTC