# Logstash exits after less than a minute?

**URL:** https://discuss.elastic.co/t/logstash-exits-after-less-than-a-minute/85035
**Category:** Logstash
**Created:** [May 9, 2017, 8:13am UTC](https://discuss.elastic.co/t/logstash-exits-after-less-than-a-minute/85035 "2017-05-09T08:13:15Z")
**Posts on this page:** 8
**Page:** 1

<div class="post-metadata">

### Author: ![BrunoC](https://avatars.discourse-cdn.com/v4/letter/b/2acd7d/32.png) [@BrunoC](https://discuss.elastic.co/u/BrunoC)
#### Post date: [May 9, 2017, 8:13am UTC](https://discuss.elastic.co/t/logstash-exits-after-less-than-a-minute/85035/1 "2017-05-09T08:13:15Z")

</div>

Hi guys,

I'm having a big problem, when I start Logstash's service it exits after a few seconds. (When checking it's statut it says "active (exited)", I managed to have it run for a few hours last week but now it's just not working.

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [May 9, 2017, 8:16am UTC](https://discuss.elastic.co/t/logstash-exits-after-less-than-a-minute/85035/2 "2017-05-09T08:16:05Z")

</div>

Have you checked the Logstash logs?

---

<div class="post-metadata">

### Author: ![BrunoC](https://avatars.discourse-cdn.com/v4/letter/b/2acd7d/32.png) [@BrunoC](https://discuss.elastic.co/u/BrunoC)
#### Post date: [May 9, 2017, 8:17am UTC](https://discuss.elastic.co/t/logstash-exits-after-less-than-a-minute/85035/3 "2017-05-09T08:17:31Z")

</div>

Where are they located?

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [May 9, 2017, 8:22am UTC](https://discuss.elastic.co/t/logstash-exits-after-less-than-a-minute/85035/4 "2017-05-09T08:22:04Z")

</div>

Typically in /var/log/logstash, but could be elsewhere depending on how Logstash is configured on your machine.

---

<div class="post-metadata">

### Author: ![BrunoC](https://avatars.discourse-cdn.com/v4/letter/b/2acd7d/32.png) [@BrunoC](https://discuss.elastic.co/u/BrunoC)
#### Post date: [May 9, 2017, 8:26am UTC](https://discuss.elastic.co/t/logstash-exits-after-less-than-a-minute/85035/5 "2017-05-09T08:26:13Z")

</div>

Found them, way too messy to be able to read them, my logstash is getting logs from pfSense and I just disable pfSense sending logs and now Logstash doesn't exit anymore. Could logstash crash if he gets too many data?

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [May 9, 2017, 8:38am UTC](https://discuss.elastic.co/t/logstash-exits-after-less-than-a-minute/85035/6 "2017-05-09T08:38:55Z")

</div>

> Could logstash crash if he gets too many data?

Not likely.

---

<div class="post-metadata">

### Author: ![BrunoC](https://avatars.discourse-cdn.com/v4/letter/b/2acd7d/32.png) [@BrunoC](https://discuss.elastic.co/u/BrunoC)
#### Post date: [May 9, 2017, 8:48am UTC](https://discuss.elastic.co/t/logstash-exits-after-less-than-a-minute/85035/7 "2017-05-09T08:48:48Z")

</div>

I would gladly give you the logs from Logstash but it's just a mess.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 6, 2017, 9:01am UTC](https://discuss.elastic.co/t/logstash-exits-after-less-than-a-minute/85035/8 "2017-06-06T09:01:13Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
