# LogStash is running but Not processing Logs

**URL:** <https://discuss.elastic.co/t/logstash-is-running-but-not-processing-logs/240491>\
**Category:** Logstash\
**Created:** [July 9, 2020, 8:23am UTC](https://discuss.elastic.co/t/logstash-is-running-but-not-processing-logs/240491 "2020-07-09T08:23:36Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![singh.piyush862](https://avatars.discourse-cdn.com/v4/letter/s/7ea924/32.png) [@singh.piyush862](https://discuss.elastic.co/u/singh.piyush862)\
**Post date:** [July 9, 2020, 8:23am UTC](https://discuss.elastic.co/t/logstash-is-running-but-not-processing-logs/240491/1 "2020-07-09T08:23:36Z")

</div>

Hi All,

We started Logstash service & it process the syslog data but suddenly it stopped processing logs (I could not see new logs in Kibaan/elastic search index) however Syslog is running.

- Elastic search is rusnning
- Syslog listener is consuming new logs from source

Please suggest how to diagnosis this issue ?

Below is logstash plain logs

-sh-4.1$ cat logstash-plain.log | tail  
[2020-07-08T18:29:04,651][WARN][logstash.outputs.elasticsearch][main] Detected a 6.x and above cluster: the `type` event field won't be used to determine the document \_type {:es\_version=\>7}  
[2020-07-08T18:29:04,725][INFO][logstash.outputs.elasticsearch][main] New Elasticsearch output {:class=\>"LogStash::Outputs::ElasticSearch", :hosts=\>["//:9200"]}  
[2020-07-08T18:29:04,807][INFO][logstash.outputs.elasticsearch][main] Using default mapping template  
[2020-07-08T18:29:04,900][INFO][logstash.outputs.elasticsearch][main] Attempting to install template {:manage\_template=\>{"index\_patterns"=\>"logstash-_", "version"=\>60001, "settings"=\>{"index.refresh\_interval"=\>"5s", "number\_of\_shards"=\>1}, "mappings"=\>{"dynamic\_templates"=\>[{"message\_field"=\>{"path\_match"=\>"message", "match\_mapping\_type"=\>"string", "mapping"=\>{"type"=\>"text", "norms"=\>false}}}, {"string\_fields"=\>{"match"=\>"_", "match\_mapping\_type"=\>"string", "mapping"=\>{"type"=\>"text", "norms"=\>false, "fields"=\>{"keyword"=\>{"type"=\>"keyword", "ignore\_above"=\>256}}}}}], "properties"=\>{"@timestamp"=\>{"type"=\>"date"}, "@version"=\>{"type"=\>"keyword"}, "geoip"=\>{"dynamic"=\>true, "properties"=\>{"ip"=\>{"type"=\>"ip"}, "location"=\>{"type"=\>"geo\_point"}, "latitude"=\>{"type"=\>"half\_float"}, "longitude"=\>{"type"=\>"half\_float"}}}}}}}  
[2020-07-08T18:29:05,591][WARN][org.logstash.instrument.metrics.gauge.LazyDelegatingGauge][main] A gauge metric of an unknown type (org.jruby.specialized.RubyArrayOneObject) has been create for key: cluster\_uuids. This may result in invalid serialization. It is recommended to log an issue to the responsible developer/development team.  
[2020-07-08T18:29:05,598][INFO][logstash.javapipeline][main] Starting pipeline {:pipeline\_id=\>"main", "pipeline.workers"=\>16, "pipeline.batch.size"=\>125, "pipeline.batch.delay"=\>50, "pipeline.max\_inflight"=\>2000, "pipeline.sources"=\>["/etc/logstash/conf.d/NsgSyslogLogstash.conf"], :thread=\>"#\<Thread:0x4658448c run\>"}  
[2020-07-08T18:29:06,129][INFO][logstash.javapipeline][main] Pipeline started {"pipeline.id"=\>"main"}  
[2020-07-08T18:29:06,207][INFO][logstash.agent] Pipelines running {:count=\>1, :running\_pipelines=\>[:main], :non\_running\_pipelines=\>}  
[2020-07-08T18:29:06,214][INFO][filewatch.observingtail][main] START, creating Discoverer, Watch with file and sincedb collections  
[2020-07-08T18:29:06,572][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 6, 2020, 8:23am UTC](https://discuss.elastic.co/t/logstash-is-running-but-not-processing-logs/240491/2 "2020-08-06T08:23:37Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.