# Logstash service stop working

**URL:** <https://discuss.elastic.co/t/logstash-service-stop-working/54051>\
**Category:** Logstash\
**Created:** [June 27, 2016, 2:47pm UTC](https://discuss.elastic.co/t/logstash-service-stop-working/54051 "2016-06-27T14:47:23Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![William\_Leclerc](https://avatars.discourse-cdn.com/v4/letter/w/9fc29f/32.png) [@William\_Leclerc](https://discuss.elastic.co/u/William_Leclerc)\
**Post date:** [June 27, 2016, 2:47pm UTC](https://discuss.elastic.co/t/logstash-service-stop-working/54051/1 "2016-06-27T14:47:23Z")

</div>

Here is my configuration that works for us at the moment ( Filebeat -\> Logstash -\> Elasticsearch)

```
input {
  beats {
    port => 5044
    ssl => true
    ssl_certificate => "/etc/pki/tls/certs/logstash-forwarder.crt"
    ssl_key => "/etc/pki/tls/private/logstash-forwarder.key"
  }
}
filter {
  if [type] == "syslog" {
    grok {
      match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
      add_field => ["received_at", "%{@timestamp}"]
      add_field => ["received_from", "%{host}"]
    }
    syslog_pri { }
    date {
      match => ["syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]
    }
  }
}
output {
  elasticsearch {
    hosts => ["localhost:9200"]
    sniffing => true
    manage_template => false
    index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
    document_type => "%{[@metadata][type]}"
  }
}

```

The problem is I also want my log to be stored into files on the server so I added the file plugin.  
`output { elasticsearch { hosts => ["localhost:9200"] sniffing => true manage_template => false index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}" document_type => "%{[@metadata][type]}" } file { path => "/var/data/syslog/%{+YYYY}/%{+MM}/%{+dd}/%{hostname}/%{source}.log" } }`

logstash configtest  
`Configuration OK`

I restart logstash and it runs fine for few minutes then as soon as Filebeat sends a file to logstash the service stop working.

I have nothing in my logstash log even with ' stdout ' in my output config.

Anything wrong with my config ? My codec ? Is it possible to send filebeat input to file output ?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [June 29, 2016, 12:45am UTC](https://discuss.elastic.co/t/logstash-service-stop-working/54051/2 "2016-06-29T00:45:22Z")

</div>

Can you try running with debug and verbose modes?

---

<div class="post-metadata">

**Author:** ![William\_Leclerc](https://avatars.discourse-cdn.com/v4/letter/w/9fc29f/32.png) [@William\_Leclerc](https://discuss.elastic.co/u/William_Leclerc)\
**Post date:** [June 29, 2016, 1:13pm UTC](https://discuss.elastic.co/t/logstash-service-stop-working/54051/3 "2016-06-29T13:13:43Z")

</div>

./bin/logstash -f /etc/logstash/conf.d/\*.conf -v --debug --verbose  
\> Settings: Default pipeline workers: 1  
\> Logstash startup completed

Meanwhile my filebeat is running and sent file:

> ```
> 2016/06/29 12:54:39.159609 output.go:87: DBG output worker: publish 4 events
> 2016/06/29 12:54:39.168321 publish.go:104: INFO Events sent: 4
> 2016/06/29 12:54:39.168648 registrar.go:162: INFO Registry file updated. 2 states written.
> 
> ```

Still nothing on the Logstash side and nothing in the /var/log/logstash/logstash.log

If we look at the Filebeat report above we see the date 2016/06/29 12:54:39 while my system time is : Wed Jun 29 08:54:39 EDT 2016.  
As far as I know it should not be an issue since im parsing the logs in Logstash to adjust timestamp.  
Thanks

---

<div class="post-metadata">

**Author:** ![William\_Leclerc](https://avatars.discourse-cdn.com/v4/letter/w/9fc29f/32.png) [@William\_Leclerc](https://discuss.elastic.co/u/William_Leclerc)\
**Post date:** [June 29, 2016, 2:45pm UTC](https://discuss.elastic.co/t/logstash-service-stop-working/54051/4 "2016-06-29T14:45:06Z")

</div>

[solved]  
I did not have the right permission on the folder !!!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:50am UTC](https://discuss.elastic.co/t/logstash-service-stop-working/54051/5 "2017-07-06T04:50:25Z")

</div>