# Logstash service stops after few minutes **URL:** \ **Category:** Logstash\ **Created:** [November 30, 2015, 11:03pm UTC](https://discuss.elastic.co/t/logstash-service-stops-after-few-minutes/35968 "2015-11-30T23:03:37Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![ananthanaidu](https://avatars.discourse-cdn.com/v4/letter/a/f08c70/32.png) [@ananthanaidu](https://discuss.elastic.co/u/ananthanaidu)\ **Post date:** [November 30, 2015, 11:03pm UTC](https://discuss.elastic.co/t/logstash-service-stops-after-few-minutes/35968/1 "2015-11-30T23:03:37Z")
Hello Greetings, Can some one help us to fix as we start logstash service it stops with in few minutes and logs shows with the below error, **{:timestamp=\>"2015-11-30T13:04:07.450000-0600", :message=\>"The error reported is: \n pattern %{HOST:WebSiteName} not defined"}** **~** ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [November 30, 2015, 11:25pm UTC](https://discuss.elastic.co/t/logstash-service-stops-after-few-minutes/35968/2 "2015-11-30T23:25:31Z")
What version are you on, what does your config look like? ---
**Author:** ![ananthanaidu](https://avatars.discourse-cdn.com/v4/letter/a/f08c70/32.png) [@ananthanaidu](https://discuss.elastic.co/u/ananthanaidu)\ **Post date:** [November 30, 2015, 11:49pm UTC](https://discuss.elastic.co/t/logstash-service-stops-after-few-minutes/35968/3 "2015-11-30T23:49:53Z")
Version: logstash1.5 **30-lumberjack-output.conf** output { stdout { codec =\> rubydebug } if [URI] != ""{ elasticsearch { host =\> "[testlogs.com](http://testlogs.com)" cluster =\> "ElasticLogs" protocol=\> "http" index =\> "weblogs-%{+YYYY.MM.dd}" manage\_template =\> "false" } } else{ elasticsearch { host =\> "[testlogs.com](http://testlogs.com)" cluster =\> "ElasticLogs" protocol=\> "http" index =\> "errorlog-%{+YYYY.MM.dd}" manage\_template =\> "false" } } } **01-lumberjack-input.conf** input { lumberjack { port =\> 5043 type =\> "logs" ssl\_certificate =\> "/etc/pki/tls/certs/logstash-forwarder.crt" ssl\_key =\> "/etc/pki/tls/private/logstash-forwarder.key" } } ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [December 1, 2015, 6:40am UTC](https://discuss.elastic.co/t/logstash-service-stops-after-few-minutes/35968/4 "2015-12-01T06:40:17Z")
Okay, those are the input and outputs but what about the grok filters (or whatever is producing the error message)? ---
**Author:** ![ananthanaidu](https://avatars.discourse-cdn.com/v4/letter/a/f08c70/32.png) [@ananthanaidu](https://discuss.elastic.co/u/ananthanaidu)\ **Post date:** [December 1, 2015, 5:21pm UTC](https://discuss.elastic.co/t/logstash-service-stops-after-few-minutes/35968/5 "2015-12-01T17:21:09Z")
here you go . filter { grok { ``` match => { 'message' => '\A%{TIMESTAMP_ISO8601:DateTime}%{SPACE}%{URIPATHPARAM:URI}%{SPACE}%{INT:Status}%{SPACE}%{QUOTEDSTRING:ComputerName}%{SPACE}%{QUOTEDSTRING:Referer}%{SPACE}%{INT:Win32Status}%{SPACE}%{NUMBER:BytesSent}%{SPACE}%{NUMBER:BytesReceived}%{SPACE}%{QUOTEDSTRING:UserAgent}%{SPACE}%{IP:ServerIP}%{SPACE}%{INT:ServerPort}%{SPACE}%{QUOTEDSTRING:Protocol}%{SPACE}%{PROG:Method}%{SPACE}%{IP:ClientIP}%{SPACE}%{NUMBER:TimeTaken}%{SPACE}%{NUMBER:RequestPerSecond}%{SPACE}%{HOST:WebSiteName}%{SPACE}%{GREEDYDATA:QRY}' } ``` } **# The timestamp may have commas instead of dots. Convert so as to store everything in the same way** ``` mutate { gsub => [ # replace all commas with dots "DateTime", ",", "." ] } mutate { gsub => [ # make the logTimestamp sortable. With a space, it is not! This does not work that well, in the end # but somehow apparently makes things easier for the date filter "DateTime", " ", ";" ] } ``` **# User Agent** ``` useragent { add_tag => ["UA"] source => "UserAgent" } date { locale => "en" match => ["DateTime", "YYYY-MM-dd;HH:mm:ss.SSS"] target => "@timestamp" } if [type] == "IISlogs" { if [UserAgent] != "-" and [UserAgent] != "" { useragent { add_tag => ["UA"] source => "UserAgent" } } if "UA" in [tags] { if [device] == "Other" { mutate { remove_field => "device" } } if [name] == "Other" { mutate { remove_field => "name" } } if [os] == "Other" { mutate { remove_field => "os" } } } } geoip { source => "ClientIP" target => "geoip" database =>"/etc/logstash/GeoLiteCity.dat" add_field => ["[geoip][coordinates]", "%{[geoip][longitude]}" ] add_field => ["[geoip][coordinates]", "%{[geoip][latitude]}" ] } mutate { convert => ["[geoip][coordinates]", "float" ] convert => ["BytesSent", "integer"] convert => ["BytesReceived", "integer"] convert => ["RequestsPerSecond", "integer"] } ``` } ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [December 1, 2015, 5:46pm UTC](https://discuss.elastic.co/t/logstash-service-stops-after-few-minutes/35968/6 "2015-12-01T17:46:15Z")
That's odd. HOST is definitely a valid pattern in Logstash 1.5. Does the problem go away if you delete that part from the grok expression? Have you double-checked that you don't have any weird non-printable characters in the expression? What's _actually_ in your grok pattern files (have a look in /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-patterns-core-\*/patterns/grok-patterns)? ---
**Author:** ![ananthanaidu](https://avatars.discourse-cdn.com/v4/letter/a/f08c70/32.png) [@ananthanaidu](https://discuss.elastic.co/u/ananthanaidu)\ **Post date:** [December 1, 2015, 7:26pm UTC](https://discuss.elastic.co/t/logstash-service-stops-after-few-minutes/35968/7 "2015-12-01T19:26:15Z")
Yes, I tried **{HOST:WebSiteName}** changing this Grok pattern to **{HOSTNAME:WebSiteName}** and it works like charm. Thanks. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 5:20am UTC](https://discuss.elastic.co/t/logstash-service-stops-after-few-minutes/35968/8 "2017-07-06T05:20:30Z")