# Logstash shutting down without noticable error
**URL:** https://discuss.elastic.co/t/logstash-shutting-down-without-noticable-error/231236
**Category:** Logstash
**Created:** [May 6, 2020, 12:41am UTC](https://discuss.elastic.co/t/logstash-shutting-down-without-noticable-error/231236 "2020-05-06T00:41:52Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@Thaylin](https://discuss.elastic.co/u/Thaylin)
#### Post date: [May 6, 2020, 12:41am UTC](https://discuss.elastic.co/t/logstash-shutting-down-without-noticable-error/231236/1 "2020-05-06T00:41:53Z")
For some reason after logstash starts the API endpoint it shuts down.
> [2020-05-05T20:22:54,694][WARN][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
> [2020-05-05T20:22:54,776][INFO][logstash.runner] Starting Logstash {"logstash.version"=\>"7.6.2"}
> [2020-05-05T20:22:55,019][INFO][org.reflections.Reflections] Reflections took 27 ms to scan 1 urls, producing 20 keys and 40 values
> [2020-05-05T20:22:55,282][INFO][logstash.outputs.elasticsearch][main] Elasticsearch pool URLs updated {:changes=\>{:removed=\>, :added=\>[[http://logstash\_writer:xxxxxx@127.0.0.1:9200/](http://logstash_writer:xxxxxx@127.0.0.1:9200/)]}}
> [2020-05-05T20:22:55,378][WARN][logstash.outputs.elasticsearch][main] Restored connection to ES instance {:url=\>"[http://logstash\_writer:xxxxxx@127.0.0.1:9200/](http://logstash_writer:xxxxxx@127.0.0.1:9200/)"}
> [2020-05-05T20:22:55,407][INFO][logstash.outputs.elasticsearch][main] ES Output version determined {:es\_version=\>7}
> [2020-05-05T20:22:55,409][WARN][logstash.outputs.elasticsearch][main] Detected a 6.x and above cluster: the `type` event field won't be used to determine the document \_type {:es\_version=\>7}
> [2020-05-05T20:22:55,440][INFO][logstash.outputs.elasticsearch][main] New Elasticsearch output {:class=\>"LogStash::Outputs::Elasticsearch", :hosts=\>["[//127.0.0.1:9200](https://127.0.0.1:9200)"]}
> [2020-05-05T20:22:55,476][INFO][logstash.javapipeline][main] Starting pipeline {:pipeline\_id=\>"main", "pipeline.workers"=\>4, "pipeline.batch.size"=\>125, "pipeline.batch.delay"=\>50, "pipeline.max\_inflight"=\>500, "pipeline.sources"=\>["/etc/logstash/conf.d/basic\_ls\_config"], :thread=\>"#\"}
> [2020-05-05T20:22:56,079][INFO][logstash.javapipeline][main] Pipeline started {"pipeline.id"=\>"main"}
> [2020-05-05T20:22:56,103][INFO][logstash.agent] Pipelines running {:count=\>1, :running\_pipelines=\>[:main], :non\_running\_pipelines=\>}
> [2020-05-05T20:22:56,141][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600}
> [2020-05-05T20:22:56,633][INFO][logstash.runner] Logstash shut down.
I am able to pull from 9200 fine:
> curl [http://127.0.0.1:9200/](http://127.0.0.1:9200/)
> {
> "name" : "elk-prod01-elk-prod01",
> "cluster\_name" : "elasticsearch",
> "cluster\_uuid" : "pHLpTCY5Q4C4vXjphy9SMg",
> "version" : {
> "number" : "7.6.2",
> "build\_flavor" : "default",
> "build\_type" : "rpm",
> "build\_hash" : "ef48eb35cf30adf4db14086e8aabd07ef6fb113f",
> "build\_date" : "2020-03-26T06:34:37.794943Z",
> "build\_snapshot" : false,
> "lucene\_version" : "8.4.0",
> "minimum\_wire\_compatibility\_version" : "6.8.0",
> "minimum\_index\_compatibility\_version" : "6.0.0-beta1"
> },
> "tagline" : "You Know, for Search"
> }
> input { elasticsearch {
> hosts =\> "localhost"
> user =\> xxxxxxxxxx
> password =\> "xxxxxxxxx" }
> }
> filter {}
> output {
> elasticsearch {
> hosts =\> ["127.0.0.1:9200"]
> index =\> "%{[some\_field][sub\_field]}-%{+YYYY.MM.dd}"
> user =\> xxxxxxx
> password =\> "xxxxxx"
> manage\_template =\> "false"
> template\_name =\> "logstash"
> ilm\_enabled =\> true}
> }
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [May 6, 2020, 1:19am UTC](https://discuss.elastic.co/t/logstash-shutting-down-without-noticable-error/231236/2 "2020-05-06T01:19:36Z")
You may need a `query` and `index` parameter in your input, otherwise it doesn't know what data you want to retrive.
---
### Author:  [@Thaylin](https://discuss.elastic.co/u/Thaylin)
#### Post date: [May 6, 2020, 1:42am UTC](https://discuss.elastic.co/t/logstash-shutting-down-without-noticable-error/231236/3 "2020-05-06T01:42:05Z")
I added
query =\> '{ "query": { "match": { "statuscode": 200 } }, "sort": ["\_doc"] }'
Now I am getting basically the same
> [2020-05-05T21:37:41,991][WARN][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
> [2020-05-05T21:37:42,071][INFO][logstash.runner] Starting Logstash {"logstash.version"=\>"7.6.2"}
> [2020-05-05T21:37:42,352][INFO][org.reflections.Reflections] Reflections took 27 ms to scan 1 urls, producing 20 keys and 40 values
> [2020-05-05T21:37:42,618][INFO][logstash.outputs.elasticsearch][main] Elasticsearch pool URLs updated {:changes=\>{:removed=\>, :added=\>[[http://logstash\_writer:xxxxxx@127.0.0.1:9200/](http://logstash_writer:xxxxxx@127.0.0.1:9200/)]}}
> [2020-05-05T21:37:42,735][WARN][logstash.outputs.elasticsearch][main] Restored connection to ES instance {:url=\>"[http://logstash\_writer:xxxxxx@127.0.0.1:9200/](http://logstash_writer:xxxxxx@127.0.0.1:9200/)"}
> [2020-05-05T21:37:42,768][INFO][logstash.outputs.elasticsearch][main] ES Output version determined {:es\_version=\>7}
> [2020-05-05T21:37:42,770][WARN][logstash.outputs.elasticsearch][main] Detected a 6.x and above cluster: the `type` event field won't be used to determine the document \_type {:es\_version=\>7}
> [2020-05-05T21:37:42,803][INFO][logstash.outputs.elasticsearch][main] New Elasticsearch output {:class=\>"LogStash::Outputs::Elasticsearch", :hosts=\>["[//127.0.0.1:9200](https://127.0.0.1:9200)"]}
> [2020-05-05T21:37:42,827][INFO][logstash.javapipeline][main] Starting pipeline {:pipeline\_id=\>"main", "pipeline.workers"=\>4, "pipeline.batch.size"=\>125, "pipeline.batch.delay"=\>50, "pipeline.max\_inflight"=\>500, "pipeline.sources"=\>["/etc/logstash/conf.d/basic\_ls\_config"], :thread=\>"#\"}
> [2020-05-05T21:37:43,449][INFO][logstash.javapipeline][main] Pipeline started {"pipeline.id"=\>"main"}
> [2020-05-05T21:37:43,476][INFO][logstash.agent] Pipelines running {:count=\>1, :running\_pipelines=\>[:main], :non\_running\_pipelines=\>}
> [2020-05-05T21:37:43,513][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600}
> [2020-05-05T21:37:44,002][INFO][logstash.runner] Logstash shut down.
The index has a default value of logstash-\*
Though I am a newb and am assuredly missing something.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 3, 2020, 1:42am UTC](https://discuss.elastic.co/t/logstash-shutting-down-without-noticable-error/231236/4 "2020-06-03T01:42:05Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.