# Logstash Ouptut to Elasticsearch when one node is down **URL:** \ **Category:** Elasticsearch\ **Created:** [April 21, 2021, 5:00pm UTC](https://discuss.elastic.co/t/logstash-ouptut-to-elasticsearch-when-one-node-is-down/270876 "2021-04-21T17:00:29Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![linfordwoode](https://avatars.discourse-cdn.com/v4/letter/l/5fc32e/32.png) [@linfordwoode](https://discuss.elastic.co/u/linfordwoode)\ **Post date:** [April 21, 2021, 5:00pm UTC](https://discuss.elastic.co/t/logstash-ouptut-to-elasticsearch-when-one-node-is-down/270876/1 "2021-04-21T17:00:29Z")
Logstash sending output to three ES nodes. When one ES node is down, Logstash doesn't forward specific outputs to other nodes, probably because the dead node was receiving the output. For example, in the Logstash conf below, when one elasticsearchhost1 node is down, I don't see traffic going to the dev-internal or test-external index but the other index receives traffic. When elasticsearchhost2 is down, I don't see traffic going to let's say test-internal index. When all nodes are up, I see all output in Kibana. Is there a way to prevent this behavior? ```auto input { beats { port => "5044" host => "0.0.0.0" } } filter { if "beats_input_codec_plain_applied" in [tags] { mutate { remove_tag => ["beats_input_codec_plain_applied"] } } } output { if "test-int" in [fields][environment] { elasticsearch { hosts => ["elasticsearchhost1:9200", "elasticsearchhost2:9200", "elasticsearchhost3:9200"] cacert => "path/to/cert" index => "test-internal-%{+yyyy.MM.dd}" user => "elastic" password => "secret" } } else if "test-ext" in [fields][environment] { elasticsearch { hosts => ["elasticsearchhost1:9200", "elasticsearchhost2:9200", "elasticsearchhost3:9200"] cacert => "path/to/cert" index => "test-external-%{+yyyy.MM.dd}" user => "elastic" password => "secret" } } else if "dev-int" in [fields][environment] { elasticsearch { hosts => ["elasticsearchhost1:9200", "elasticsearchhost2:9200", "elasticsearchhost3:9200"] cacert => "path/to/cert" index => "dev-external-%{+yyyy.MM.dd}" user => "elastic" password => "secret" } else if "dev-ext" in [fields][environment] { elasticsearch { hosts => ["elasticsearchhost1:9200", "elasticsearchhost2:9200", "elasticsearchhost3:9200"] cacert => "path/to/cert" index => "dev-external-%{+yyyy.MM.dd}" user => "elastic" password => "secret" } else { elasticsearch { hosts => ["elasticsearchhost1:9200", "elasticsearchhost2:9200", "elasticsearchhost3:9200"] cacert => "path/to/cert" index => "iis-%{+yyyy.MM.dd}" user => "elastic" password => "secret" } } stdout { codec => rubydebug } } ``` ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [April 21, 2021, 11:16pm UTC](https://discuss.elastic.co/t/logstash-ouptut-to-elasticsearch-when-one-node-is-down/270876/2 "2021-04-21T23:16:56Z")
What version are you on? It should realise that the node is unreachable and then try another one. ---
**Author:** ![linfordwoode](https://avatars.discourse-cdn.com/v4/letter/l/5fc32e/32.png) [@linfordwoode](https://discuss.elastic.co/u/linfordwoode)\ **Post date:** [April 22, 2021, 4:28am UTC](https://discuss.elastic.co/t/logstash-ouptut-to-elasticsearch-when-one-node-is-down/270876/3 "2021-04-22T04:28:30Z")
ES running on version 7.10.2 for all nodes. For Logstash, two nodes are running 7.10.2 and one node is running 7.6.2(version upgrade in progress) Kibana version on 7.10.2 on all three nodes. Could it be the version mismatch ? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [April 22, 2021, 5:17am UTC](https://discuss.elastic.co/t/logstash-ouptut-to-elasticsearch-when-one-node-is-down/270876/4 "2021-04-22T05:17:56Z")
Not on the Elasticsearch side, more on the Logstash side as there has been work done on that output plugin. ---
**Author:** ![linfordwoode](https://avatars.discourse-cdn.com/v4/letter/l/5fc32e/32.png) [@linfordwoode](https://discuss.elastic.co/u/linfordwoode)\ **Post date:** [April 22, 2021, 12:33pm UTC](https://discuss.elastic.co/t/logstash-ouptut-to-elasticsearch-when-one-node-is-down/270876/5 "2021-04-22T12:33:29Z")
Could you please explain this comment? Did you mean there have been changes to Logstash output plugins? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [April 26, 2021, 5:14am UTC](https://discuss.elastic.co/t/logstash-ouptut-to-elasticsearch-when-one-node-is-down/270876/6 "2021-04-26T05:14:22Z")
It only applies if you were running an older version of Logstash, which you are not. ---
**Author:** ![linfordwoode](https://avatars.discourse-cdn.com/v4/letter/l/5fc32e/32.png) [@linfordwoode](https://discuss.elastic.co/u/linfordwoode)\ **Post date:** [April 28, 2021, 1:52pm UTC](https://discuss.elastic.co/t/logstash-ouptut-to-elasticsearch-when-one-node-is-down/270876/7 "2021-04-28T13:52:52Z")
Yeah that was what I thought. I am also experiencing another behavior with Logstash. In Logstash logs, i am getting below errors. ```auto Attempted to send a bulk request to elasticsearch' but Elasticsearch appears to be unreachable or down ``` However, I can confirm Elasticsearch is up all the time because there are beats from other environments shipping to Elasticsearch directly without going through Logstash. These logs look good and there are no delays. Any thoughts? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 26, 2021, 1:53pm UTC](https://discuss.elastic.co/t/logstash-ouptut-to-elasticsearch-when-one-node-is-down/270876/8 "2021-05-26T13:53:47Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.