# Logstash instance shutdown after some time atomatically

**URL:** <https://discuss.elastic.co/t/logstash-instance-shutdown-after-some-time-atomatically/138119>\
**Category:** Logstash\
**Created:** [July 2, 2018, 6:07am UTC](https://discuss.elastic.co/t/logstash-instance-shutdown-after-some-time-atomatically/138119 "2018-07-02T06:07:13Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![Suresh\_Pal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/suresh_pal/32/31571_2.png) [@Suresh\_Pal](https://discuss.elastic.co/u/Suresh_Pal)\
**Post date:** [July 2, 2018, 6:07am UTC](https://discuss.elastic.co/t/logstash-instance-shutdown-after-some-time-atomatically/138119/1 "2018-07-02T06:07:14Z")

</div>

I'm running logstash instance using data directory. But after sometime it stops shipping logs though instance keep running . Then after removing the data directory and creating same directory again it start shipping. Please help it is happening. can't delete data directory again and again.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 2, 2018, 7:10am UTC](https://discuss.elastic.co/t/logstash-instance-shutdown-after-some-time-atomatically/138119/2 "2018-07-02T07:10:10Z")

</div>

Have you looked in the Logstash log file for clues? What does your Logstash configuration look like?

---

<div class="post-metadata">

**Author:** ![Suresh\_Pal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/suresh_pal/32/31571_2.png) [@Suresh\_Pal](https://discuss.elastic.co/u/Suresh_Pal)\
**Post date:** [July 3, 2018, 6:42am UTC](https://discuss.elastic.co/t/logstash-instance-shutdown-after-some-time-atomatically/138119/3 "2018-07-03T06:42:53Z")

</div>

you mean logstash.yml ??

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 3, 2018, 7:16am UTC](https://discuss.elastic.co/t/logstash-instance-shutdown-after-some-time-atomatically/138119/4 "2018-07-03T07:16:41Z")

</div>

No, I meant the pipeline configuration files.

---

<div class="post-metadata">

**Author:** ![Suresh\_Pal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/suresh_pal/32/31571_2.png) [@Suresh\_Pal](https://discuss.elastic.co/u/Suresh_Pal)\
**Post date:** [July 3, 2018, 8:48am UTC](https://discuss.elastic.co/t/logstash-instance-shutdown-after-some-time-atomatically/138119/5 "2018-07-03T08:48:48Z")

</div>

For builds log i have this configuration file.

input { beats {  
port =\> "5044"  
}  
}  
filter {

grok {

```
    match => { "message" => "%{TIMESTAMP_ISO8601:timestamp} [%{LOGLEVEL:level}]%{GREEDYDATA:messageText}%{IP:client}" }

```

}  
date {  
match =\> ["timestamp", "yyyy-MM-dd HH:mm:ss.SSS", "ISO8601"]  
timezone =\> "UTC"  
}  
}

output {  
elasticsearch { hosts =\> ["localhost:9200"] }

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 3, 2018, 8:52am UTC](https://discuss.elastic.co/t/logstash-instance-shutdown-after-some-time-atomatically/138119/6 "2018-07-03T08:52:09Z")

</div>

Okay. There's nothing in there that should trigger shutdowns. I'd bet there's something in the logs.

---

<div class="post-metadata">

**Author:** ![Suresh\_Pal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/suresh_pal/32/31571_2.png) [@Suresh\_Pal](https://discuss.elastic.co/u/Suresh_Pal)\
**Post date:** [July 3, 2018, 9:46am UTC](https://discuss.elastic.co/t/logstash-instance-shutdown-after-some-time-atomatically/138119/7 "2018-07-03T09:46:39Z")

</div>

This is what my log files contains

tail -f /var/log/logstash/logstash-plain.log /var/log/logstash-stderr.log /var/log/logstash-stdout.log  
==\> /var/log/logstash/logstash-plain.log \<==

==\> /var/log/logstash-stderr.log \<==

==\> /var/log/logstash-stdout.log \<==  
[2018-06-21T04:31:23,866][INFO][logstash.inputs.beats] Beats inputs: Starting input listener {:address=\>"0.0.0.0:5044"}  
[2018-06-21T04:31:24,050][INFO][logstash.inputs.s3] Registering s3 input {:bucket=\>"fcalb-logs", :region=\>"us-east-1"}  
[2018-06-21T04:31:27,425][INFO][logstash.inputs.s3] Registering s3 input {:bucket=\>"fcalb-logs", :region=\>"us-east-1"}  
[2018-06-21T04:31:28,212][INFO][logstash.pipeline] Pipeline started successfully {:pipeline\_id=\>"main", :thread=\>"#\<Thread:0x44c1fa76 sleep\>"}  
[2018-06-21T04:31:28,282][INFO][org.logstash.beats.Server] Starting server on port: 5044  
[2018-06-21T04:31:28,691][INFO][logstash.agent] Pipelines running {:count=\>1, :running\_pipelines=\>[:main], :non\_running\_pipelines=\>[]}  
[2018-06-21T04:31:35,183][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9601}  
[2018-06-21T04:31:42,929][INFO][logstash.inputs.s3] Using default generated file for the sincedb {:filename=\>"/var/lib/logstash/plugins/inputs/s3/sincedb\_efd265798b29788b1b0436aaca127b42"}  
[2018-06-21T04:31:42,930][INFO][logstash.inputs.s3] Using default generated file for the sincedb {:filename=\>"/var/lib/logstash/plugins/inputs/s3/sincedb\_a83a7e844cdbfd1a161da5c150c3b2be"}  
[2018-06-21T04:31:52,796][WARN][logstash.runner] SIGTERM received. Shutting down

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 3, 2018, 9:48am UTC](https://discuss.elastic.co/t/logstash-instance-shutdown-after-some-time-atomatically/138119/8 "2018-07-03T09:48:45Z")

</div>

It looks like something from the outside is sending SIGTERM to the Logstash process. I don't think Logstash is a fault here.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 31, 2018, 9:48am UTC](https://discuss.elastic.co/t/logstash-instance-shutdown-after-some-time-atomatically/138119/9 "2018-07-31T09:48:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.