# Logstash file output - pipeline stop working after flush error **URL:** \ **Category:** Logstash\ **Created:** [November 18, 2025, 10:08am UTC](https://discuss.elastic.co/t/logstash-file-output-pipeline-stop-working-after-flush-error/383505 "2025-11-18T10:08:53Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![Po-temkin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/po-temkin/32/138703_2.png) [@Po-temkin](https://discuss.elastic.co/u/Po-temkin)\ **Post date:** [November 18, 2025, 10:08am UTC](https://discuss.elastic.co/t/logstash-file-output-pipeline-stop-working-after-flush-error/383505/1 "2025-11-18T10:08:53Z")
Have a nice day everyone. Not long ago, I started to notice missing syslog logs from random host groups. At first, I simply restarted our Logstash nodes that act as syslog forwarders, and the problem went away. But over the last two days, I’ve seen this happen twice, so I had to start digging deeper. At the beginning, I suspected some network-related issues, but then I correlated the last host message with several errors on a particular Logstash node. In most cases, the problem starts with one or more errors that look like this: `[2025-11-18T01:54:17,368][ERROR][logstash.outputs.file][pipeline_name] Exception flushing files {:exception=>"Unknown error (SystemCallError) - ", :backtrace=>["org/jruby/RubyIO.java:2501:in `flush'", "C:/Program Files/Logstash/vendor/bundle/jruby/3.1.0/gems/logstash-output-file-4.3.0/lib/logstash/outputs/file.rb:373:in `flush'", "C:/Program Files/Logstash/vendor/bundle/jruby/3.1.0/gems/logstash-output-file-4.3.0/lib/logstash/outputs/file.rb:208:in `block in flush_pending_files'", "org/jruby/RubyHash.java:1615:in `each'", "C:/Program Files/Logstash/vendor/bundle/jruby/3.1.0/gems/logstash-output-file-4.3.0/lib/logstash/outputs/file.rb:206:in `block in flush_pending_files'", "org/jruby/ext/thread/Mutex.java:174:in `synchronize'", "C:/Program Files/Logstash/vendor/bundle/jruby/3.1.0/gems/logstash-output-file-4.3.0/lib/logstash/outputs/file.rb:203:in `flush_pending_files'", "C:/Program Files/Logstash/vendor/bundle/jruby/3.1.0/gems/logstash-output-file-4.3.0/lib/logstash/outputs/file.rb:103:in `block in register'", "C:/Program Files/Logstash/vendor/bundle/jruby/3.1.0/gems/logstash-output-file-4.3.0/lib/logstash/outputs/file.rb:350:in `block in run'", "org/jruby/RubyKernel.java:1725:in `loop'", "C:/Program Files/Logstash/vendor/bundle/jruby/3.1.0/gems/logstash-output-file-4.3.0/lib/logstash/outputs/file.rb:346:in `block in run'", "org/jruby/ext/thread/Mutex.java:174:in `synchronize'", "C:/Program Files/Logstash/vendor/bundle/jruby/3.1.0/gems/logstash-output-file-4.3.0/lib/logstash/outputs/file.rb:345:in `run'", "C:/Program Files/Logstash/vendor/bundle/jruby/3.1.0/gems/logstash-output-file-4.3.0/lib/logstash/outputs/file.rb:321:in `block in start'"]}` Then I see this error and end up with a corrupted pipeline, and I have to restart the Logstash node manually: `[2025-11-18T01:55:53,562][ERROR][logstash.javapipeline][pipeline_name] Pipeline worker error, the pipeline will be stopped {:pipeline_id=>"pipeline_name", :error=>"(SystemCallError) Unknown error (SystemCallError) - E:/logstash/group_name/pipeline_name/hostname/2025-11-17-22.log", :exception=>Java::OrgJrubyExceptions::SystemCallError, :backtrace=>["org.jruby.RubyIO.write(org/jruby/RubyIO.java:1590)", "org.jruby.RubyIO.write(org/jruby/RubyIO.java:1522)", "C_3a_.Program_20_Files.Logstash.vendor.bundle.jruby.$3_dot_1_dot_0.gems.logstash_minus_output_minus_file_minus_4_dot_3_dot_0.lib.logstash.outputs.file.write(C:/Program Files/Logstash/vendor/bundle/jruby/3.1.0/gems/logstash-output-file-4.3.0/lib/logstash/outputs/file.rb:368)", "C_3a_.Program_20_Files.Logstash.vendor.bundle.jruby.$3_dot_1_dot_0.gems.logstash_minus_output_minus_file_minus_4_dot_3_dot_0.lib.logstash.outputs.file.multi_receive_encoded(C:/Program Files/Logstash/vendor/bundle/jruby/3.1.0/gems/logstash-output-file-4.3.0/lib/logstash/outputs/file.rb:126)", "org.jruby.RubyArray.each(org/jruby/RubyArray.java:1981)", "C_3a_.Program_20_Files.Logstash.vendor.bundle.jruby.$3_dot_1_dot_0.gems.logstash_minus_output_minus_file_minus_4_dot_3_dot_0.lib.logstash.outputs.file.multi_receive_encoded(C:/Program Files/Logstash/vendor/bundle/jruby/3.1.0/gems/logstash-output-file-4.3.0/lib/logstash/outputs/file.rb:126)", "org.jruby.RubyHash.each(org/jruby/RubyHash.java:1615)", "C_3a_.Program_20_Files.Logstash.vendor.bundle.jruby.$3_dot_1_dot_0.gems.logstash_minus_output_minus_file_minus_4_dot_3_dot_0.lib.logstash.outputs.file.multi_receive_encoded(C:/Program Files/Logstash/vendor/bundle/jruby/3.1.0/gems/logstash-output-file-4.3.0/lib/logstash/outputs/file.rb:118)", "org.jruby.ext.thread.Mutex.synchronize(org/jruby/ext/thread/Mutex.java:174)", "C_3a_.Program_20_Files.Logstash.vendor.bundle.jruby.$3_dot_1_dot_0.gems.logstash_minus_output_minus_file_minus_4_dot_3_dot_0.lib.logstash.outputs.file.multi_receive_encoded(C:/Program Files/Logstash/vendor/bundle/jruby/3.1.0/gems/logstash-output-file-4.3.0/lib/logstash/outputs/file.rb:117)", "C_3a_.Program_20_Files.Logstash.logstash_minus_core.lib.logstash.outputs.base.multi_receive(C:/Program Files/Logstash/logstash-core/lib/logstash/outputs/base.rb:102)", "org.logstash.config.ir.compiler.AbstractOutputDelegatorExt.multi_receive(org/logstash/config/ir/compiler/AbstractOutputDelegatorExt.java:121)", "RUBY.start_workers(C:/Program Files/Logstash/logstash-core/lib/logstash/java_pipeline.rb:308)"], :thread=>"#"}` Here some information related to my installation. Logstash Version: 9.0.0 OS: Windows Server 2019 Pipeline-related config: ```auto >pipelines.yml - pipeline.id: pipeline_name path.config: "C:/Program Files/logstash/etc/pipelines/pipeline_name.conf" ``` ```auto >pipeline_name.conf input { udp { port => 1118 } } filter { dns { action => "replace" hit_cache_size => 500000 hit_cache_ttl => 300 max_retries => 10 timeout => 3 reverse => ["[host]" ] } } output { file { codec => line { format => "%{message}" } path => "E:/logstash/host_group/pipeline_name/%{[host]}/%{+YYYY-MM-dd-HH}.log" } } ``` ---
**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\ **Post date:** [November 18, 2025, 4:54pm UTC](https://discuss.elastic.co/t/logstash-file-output-pipeline-stop-working-after-flush-error/383505/2 "2025-11-18T16:54:45Z")
Have you checked the field host it might host or wrong format? ---
**Author:** ![Po-temkin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/po-temkin/32/138703_2.png) [@Po-temkin](https://discuss.elastic.co/u/Po-temkin)\ **Post date:** [November 18, 2025, 6:03pm UTC](https://discuss.elastic.co/t/logstash-file-output-pipeline-stop-working-after-flush-error/383505/3 "2025-11-18T18:03:21Z")
> [@Rios](#): > > checked the field host As you can see in the second error, a full path to the log file contain “hostname” `… E:/logstash/group_name/pipeline_name/hostname/2025-11-17-22.log" …` So, If a hostname is invalid or formated wrong I will see it in this string But all files, were mentioned in these errors were created before, that means that hostnames were valid ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [November 18, 2025, 6:05pm UTC](https://discuss.elastic.co/t/logstash-file-output-pipeline-stop-working-after-flush-error/383505/4 "2025-11-18T18:05:28Z")
Is `E:/logstash` a local path or a network path? ---
**Author:** ![Po-temkin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/po-temkin/32/138703_2.png) [@Po-temkin](https://discuss.elastic.co/u/Po-temkin)\ **Post date:** [November 18, 2025, 6:16pm UTC](https://discuss.elastic.co/t/logstash-file-output-pipeline-stop-working-after-flush-error/383505/5 "2025-11-18T18:16:10Z")
It is a local path ---
**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\ **Post date:** [November 18, 2025, 7:31pm UTC](https://discuss.elastic.co/t/logstash-file-output-pipeline-stop-working-after-flush-error/383505/6 "2025-11-18T19:31:44Z")
Can you try with debug mode in the output? There is no much info from this log trace. `stdout { codec => rubydebug{} }` ---
**Author:** ![Po-temkin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/po-temkin/32/138703_2.png) [@Po-temkin](https://discuss.elastic.co/u/Po-temkin)\ **Post date:** [November 21, 2025, 11:50am UTC](https://discuss.elastic.co/t/logstash-file-output-pipeline-stop-working-after-flush-error/383505/7 "2025-11-21T11:50:00Z")
Is it possible to apply it globally? I have about 50 different pipelines, so it’s not convenient to edit each one ---
**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\ **Post date:** [November 21, 2025, 2:16pm UTC](https://discuss.elastic.co/t/logstash-file-output-pipeline-stop-working-after-flush-error/383505/8 "2025-11-21T14:16:13Z")
Yes, it's possible: 1. Add additional file e.g. output.conf in the same directory as all other .conf files ```auto output { stdout { codec => rubydebug{} } } ``` 1. Enable debug in logstash.yml to dump config values, not the output `config.debug: false` ---
**Author:** ![Po-temkin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/po-temkin/32/138703_2.png) [@Po-temkin](https://discuss.elastic.co/u/Po-temkin)\ **Post date:** [December 1, 2025, 7:24am UTC](https://discuss.elastic.co/t/logstash-file-output-pipeline-stop-working-after-flush-error/383505/9 "2025-12-01T07:24:15Z")
So, at least for now, the error is gone. Just after posting, I updated the Logstash instance to 9.1.7, and for now I see no errors. ---
**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\ **Post date:** [December 1, 2025, 12:35pm UTC](https://discuss.elastic.co/t/logstash-file-output-pipeline-stop-working-after-flush-error/383505/10 "2025-12-01T12:35:21Z")
> [@Rios](#): > > Enable debug in logstash.yml to dump config values, not the output > `config.debug: false` It's a mistake, should be: `config.debug: true` Anyway, there is no bugs reported for the output file on GHub since 2021. Might be something related to Ruby. Make sure to have enough disk space on C and E, if you have.