# Logstash not running in Remote Windows Continuously

**URL:** <https://discuss.elastic.co/t/logstash-not-running-in-remote-windows-continuously/309005>\
**Category:** Logstash\
**Created:** [July 6, 2022, 11:14am UTC](https://discuss.elastic.co/t/logstash-not-running-in-remote-windows-continuously/309005 "2022-07-06T11:14:19Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![suresh\_u](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/suresh_u/32/107394_2.png) [@suresh\_u](https://discuss.elastic.co/u/suresh_u)\
**Post date:** [July 6, 2022, 11:14am UTC](https://discuss.elastic.co/t/logstash-not-running-in-remote-windows-continuously/309005/1 "2022-07-06T11:14:20Z")

</div>

I am using Logstash-7.17.4 version to index data from oracle db to Elasticsearch.  
When I am running through Command Prompt, it is running but when running through Task Scheduler, logstash has stopped automatically after some time.

I have created 1 bat file and in that 2 commands are there::  
cd D:\logstash-7.17.4-windows-x86\_64\logstash-7.17.4\bin  
logstash -f logstash-oracle.conf

I have run Logstash as a service in Task Scheduler.

My Logstash Configuration:  
input {  
jdbc {  
clean\_run =\> true  
jdbc\_driver\_library =\> "D:\logstash-7.17.4-windows-x86\_64\logstash-7.17.4\ojdbc8.jar"  
jdbc\_driver\_class =\> "Java::oracle.jdbc.driver.OracleDriver"  
jdbc\_connection\_string =\> "jdbc:oracle:thin:@Host:1521/service-name"  
jdbc\_user =\> "user"  
jdbc\_password =\> "user123"  
schedule =\> "\*/1 \* \* \* \* \*"  
statement =\> "SELECT \* from emp"  
use\_column\_value =\> true  
tracking\_column =\> "last\_update\_date"  
tracking\_column\_type =\> "timestamp"  
}  
}  
filter {  
mutate {  
remove\_field =\> ["@version", "@timestamp"]  
copy =\> { "id" =\> "esid" }  
}  
}

output {  
elasticsearch{  
hosts =\> ["[https://domain1:9200](https://domain1:9200)","[https://domain2:9200](https://domain2:9200)","[https://domain3:9200](https://domain3:9200)"]  
index =\> "testindex"  
user =\> "user1"  
password =\> "user1"  
ssl =\> true  
ssl\_certificate\_verification =\> true  
cacert =\> 'D:\logstash-7.17.4-windows-x86\_64\logstash-7.17.4\nonprodescertificate.cer'  
document\_id =\> "%{id}"  
doc\_as\_upsert =\> true  
}   
stdout {  
codec =\> rubydebug  
}  
}  
could you @warkolm @sudhagar_ramesh @Badger please help me on this? This has to be deployed to PROD as well.

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [July 6, 2022, 12:43pm UTC](https://discuss.elastic.co/t/logstash-not-running-in-remote-windows-continuously/309005/2 "2022-07-06T12:43:37Z")

</div>

Use LS as a services with NSSM,it's easy to configure.

> **[Running Logstash on Windows | Logstash Reference \[8.3\] | Elastic](https://www.elastic.co/guide/en/logstash/current/running-logstash-windows.html#running-logstash-windows-nssm)**

---

<div class="post-metadata">

**Author:** ![suresh\_u](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/suresh_u/32/107394_2.png) [@suresh\_u](https://discuss.elastic.co/u/suresh_u)\
**Post date:** [July 6, 2022, 12:45pm UTC](https://discuss.elastic.co/t/logstash-not-running-in-remote-windows-continuously/309005/3 "2022-07-06T12:45:31Z")

</div>

sure @Rios. Thanks for the update. I will check and update.

---

<div class="post-metadata">

**Author:** ![suresh\_u](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/suresh_u/32/107394_2.png) [@suresh\_u](https://discuss.elastic.co/u/suresh_u)\
**Post date:** [July 6, 2022, 1:44pm UTC](https://discuss.elastic.co/t/logstash-not-running-in-remote-windows-continuously/309005/4 "2022-07-06T13:44:33Z")

</div>

thank you so much @Rios for your help. I have used NSSM in remote windows to run Logstash as a Service. Now it is running and updating the logs as well.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [July 10, 2022, 9:46pm UTC](https://discuss.elastic.co/t/logstash-not-running-in-remote-windows-continuously/309005/5 "2022-07-10T21:46:18Z")

</div>

In future please do not ping people that are not already part of your topic.

---

<div class="post-metadata">

**Author:** ![suresh\_u](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/suresh_u/32/107394_2.png) [@suresh\_u](https://discuss.elastic.co/u/suresh_u)\
**Post date:** [July 11, 2022, 6:30am UTC](https://discuss.elastic.co/t/logstash-not-running-in-remote-windows-continuously/309005/6 "2022-07-11T06:30:31Z")

</div>

sure @warkolm

---

<div class="post-metadata">

**Author:** ![suresh\_u](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/suresh_u/32/107394_2.png) [@suresh\_u](https://discuss.elastic.co/u/suresh_u)\
**Post date:** [July 11, 2022, 12:27pm UTC](https://discuss.elastic.co/t/logstash-not-running-in-remote-windows-continuously/309005/7 "2022-07-11T12:27:31Z")

</div>

Hi Rios,

one clarification about NSSM.  
If NSSM shuts down unexpectedly, then can we send an email alert?  
Could you please help?  
Thanks,  
Suresh.

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [July 11, 2022, 2:30pm UTC](https://discuss.elastic.co/t/logstash-not-running-in-remote-windows-continuously/309005/8 "2022-07-11T14:30:45Z")

</div>

NSSM is only to register LS as the service on Windows and it's recommended to use by Elastic. Nothing more. You need Powershell script or extra application which will monitor Logstash log.  
Check LS log, must be something inside. Set

> log.level: debug

or TRACE. Also use some other log settings. Check : `curl -XGET 'localhost:9600/_node/logging?pretty'`

Since that is Windows host, check Event logs, App and System, should be something recorded there.  
If you have a lot of events, might be your memory should be increased.

---

<div class="post-metadata">

**Author:** ![suresh\_u](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/suresh_u/32/107394_2.png) [@suresh\_u](https://discuss.elastic.co/u/suresh_u)\
**Post date:** [July 11, 2022, 3:33pm UTC](https://discuss.elastic.co/t/logstash-not-running-in-remote-windows-continuously/309005/9 "2022-07-11T15:33:17Z")

</div>

Thanks a lot for the update Rios. I will check and update.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 8, 2022, 3:34pm UTC](https://discuss.elastic.co/t/logstash-not-running-in-remote-windows-continuously/309005/10 "2022-08-08T15:34:13Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
