# Logstash monitoring and pipelines **URL:** \ **Category:** Logstash\ **Created:** [April 3, 2018, 5:20pm UTC](https://discuss.elastic.co/t/logstash-monitoring-and-pipelines/126617 "2018-04-03T17:20:32Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![webrod](https://avatars.discourse-cdn.com/v4/letter/w/6bbea6/32.png) [@webrod](https://discuss.elastic.co/u/webrod)\ **Post date:** [April 3, 2018, 5:20pm UTC](https://discuss.elastic.co/t/logstash-monitoring-and-pipelines/126617/1 "2018-04-03T17:20:32Z")
Hi, I have stopped Filebeat, no logs are pushed anymore. It is confirmed by all screens from logstash monitoring (like logstahs event received rate, or ES indexing rate), they are all set to 0, BUT the 'logstash pipeline" screen shows the tree with numbers inside. like 800 e/s. and this number is moving/refreshing around that value forever. see snapshot here: ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/4/44b07df2e377324384e14240ee820c1c10ebf19a.png) but here: ![image](https://us1.discourse-cdn.com/elastic/original/3X/f/6/f6375506204b2d243faef287cfc2b0500e6bc86e.png) how is that possible? thanks, Rod ---
**Author:** ![Evesy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/evesy/32/29520_2.png) [@Evesy](https://discuss.elastic.co/u/Evesy)\ **Post date:** [April 3, 2018, 5:26pm UTC](https://discuss.elastic.co/t/logstash-monitoring-and-pipelines/126617/2 "2018-04-03T17:26:25Z")
Hey, If you set your time picker to the last 30 minutes is it still showing around 900 event/second... Just wondering if it's because it's averaging out the last hour, in which case there were still a number of events received during that period? ---
**Author:** ![webrod](https://avatars.discourse-cdn.com/v4/letter/w/6bbea6/32.png) [@webrod](https://discuss.elastic.co/u/webrod)\ **Post date:** [April 4, 2018, 6:10am UTC](https://discuss.elastic.co/t/logstash-monitoring-and-pipelines/126617/3 "2018-04-04T06:10:15Z")
time picker is visible from the overview tab where I can see there is not event: ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/2/e20d8ef8252f86cb90f7e656a75e274c7a0925dd.png) But it is not visible when I click on "pipelines" tab: ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/1/417f4f2ec956b9e0b6020189b57c277185d56783.png) We are now 14 hours after I have stopped filebeats, and pipeline still display events/s and this rate is moving, it's not fixed, like if there were activity, but all other graph from logstash or ES shows there is nothing is that a bug? thanks, Rod ---
**Author:** ![jkambic](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jkambic/32/53306_2.png) [@jkambic](https://discuss.elastic.co/u/jkambic)\ **Post date:** [April 4, 2018, 6:35pm UTC](https://discuss.elastic.co/t/logstash-monitoring-and-pipelines/126617/4 "2018-04-04T18:35:32Z")
Hi Rod - what versions of Elasticsearch and Kibana are you using? ---
**Author:** ![wwalker](https://avatars.discourse-cdn.com/v4/letter/w/43a26b/32.png) [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Post date:** [April 5, 2018, 3:11am UTC](https://discuss.elastic.co/t/logstash-monitoring-and-pipelines/126617/5 "2018-04-05T03:11:52Z")
Just to verify, if you go to Monitoring\>Logstash\>Nodes\>Select your node\>Advanced....is there anything in the queue? ---
**Author:** ![webrod](https://avatars.discourse-cdn.com/v4/letter/w/6bbea6/32.png) [@webrod](https://discuss.elastic.co/u/webrod)\ **Post date:** [April 5, 2018, 1:43pm UTC](https://discuss.elastic.co/t/logstash-monitoring-and-pipelines/126617/6 "2018-04-05T13:43:16Z")
on top of Docker 18.03.0-ce I use those versions: FROM [docker.elastic.co/logstash/logstash-x-pack:6.2.3](http://docker.elastic.co/logstash/logstash-x-pack:6.2.3) FROM [docker.elastic.co/elasticsearch/elasticsearch-basic:6.2.3](http://docker.elastic.co/elasticsearch/elasticsearch-basic:6.2.3) FROM [docker.elastic.co/kibana/kibana-x-pack:6.2.3](http://docker.elastic.co/kibana/kibana-x-pack:6.2.3) I had to restart my VM. The queue is empty: ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/a/8a132182c7b354565d5f2258d488a483b510c915.png) every chart shows there is no event processed, even iostats shows there is no disk access. the main pipeline view says 0e/s: ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/3/9372ea0ebd6e13ebbfda3f417ba4e5b155cc4b36.png) but when I click on "main" I see events/s, and this number is moving: ![image](https://us1.discourse-cdn.com/elastic/original/3X/f/1/f13d5383a4900c45e81f4005e70b6a3ce3d488f0.png) then a few sec later: ![image](https://us1.discourse-cdn.com/elastic/original/3X/2/1/2117f95015fc12fd7821652e5820fdf3e73c9621.png) ---
**Author:** ![jkambic](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jkambic/32/53306_2.png) [@jkambic](https://discuss.elastic.co/u/jkambic)\ **Post date:** [April 6, 2018, 2:25pm UTC](https://discuss.elastic.co/t/logstash-monitoring-and-pipelines/126617/7 "2018-04-06T14:25:27Z")
Hi Rod - I think I know why you're seeing this, but I will need some time to repro your state on the same versions you're running. I'll get back to you as soon as I can! ---
**Author:** ![jkambic](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jkambic/32/53306_2.png) [@jkambic](https://discuss.elastic.co/u/jkambic)\ **Post date:** [April 15, 2018, 4:03pm UTC](https://discuss.elastic.co/t/logstash-monitoring-and-pipelines/126617/8 "2018-04-15T16:03:41Z")
Hi Rod, great that you're on 6.2! The reason you're seeing these numbers even when your Filebeat is stopped and your queue is empty is due to how PipelineViewer queries its data. Next to the pipeline name there's a dropdown that allows you to select any LS pipeline version for which there is monitoring data. As the viewer exists today, when a pipeline is selected, it displays the _lastest_ value over the lifespan of the pipeline. You may have noticed that there's no timespan picker present on that page, this is to indicate that we're not looking at the same slice of time as your other monitoring views. Regarding metrics like `e/s`, they're an aggregate of the total events output by the plugin, divided by the time series interval. As more time passes, the numerator (event count) in the calculation of metrics like `e/s` stays the same, but the denominator (the size of the time series interval) grows linearly, which is why you see changes in your numbers, which I'm guessing are gradually decreasing. To reproduce these conditions I set up a stack with MetricBeat a few days ago and let it run for about six hours. Then I killed MetricBeat and let the rest of my stack keep running and collecting monitoring data. If you check my screenshots below, you'll notice the same pattern you've seen. Additionally, I started my MetricBeat back up again and the `e/s` metrics began to rise over time. ### MetricBeat running ![52%20PM](https://us1.discourse-cdn.com/elastic/original/3X/5/6/56904593588959579273c1c3ec63204893652a25.jpg) ### MetricBeat stopped ~1 hour ![17%20PM](https://us1.discourse-cdn.com/elastic/original/3X/5/7/577f3fd4315842fdffa9cb2ff030714a6cb8ff47.jpg) ### MetricBeat stopped 30+ hours ![44%20AM](https://us1.discourse-cdn.com/elastic/original/3X/4/9/499e5c1a2b9f37ffe1a53fc688204496e01aca19.jpg) ### MetricBeat running again for ~1 hour ![48%20AM](https://us1.discourse-cdn.com/elastic/original/3X/0/d/0dd5a65dd26575ce7f2afc626d14af37105e86c2.jpg) If I can help clarify or answer any follow up questions you may have don't hesitate to ask. Have a great day. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 13, 2018, 4:03pm UTC](https://discuss.elastic.co/t/logstash-monitoring-and-pipelines/126617/9 "2018-05-13T16:03:48Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.