# Logstash startup completed and then the system hangs logs are not passed into elastic search how can i overcome this?

**URL:** https://discuss.elastic.co/t/logstash-startup-completed-and-then-the-system-hangs-logs-are-not-passed-into-elastic-search-how-can-i-overcome-this/38021
**Category:** Logstash
**Created:** [December 28, 2015, 6:28am UTC](https://discuss.elastic.co/t/logstash-startup-completed-and-then-the-system-hangs-logs-are-not-passed-into-elastic-search-how-can-i-overcome-this/38021 "2015-12-28T06:28:51Z")
**Posts on this page:** 7
**Page:** 1

<div class="post-metadata">

### Author: ![Akash\_Katakam](https://avatars.discourse-cdn.com/v4/letter/a/e68b1a/32.png) [@Akash\_Katakam](https://discuss.elastic.co/u/Akash_Katakam)
#### Post date: [December 28, 2015, 6:28am UTC](https://discuss.elastic.co/t/logstash-startup-completed-and-then-the-system-hangs-logs-are-not-passed-into-elastic-search-how-can-i-overcome-this/38021/1 "2015-12-28T06:28:51Z")

</div>

My command prompt shows logstash startup completed i changed the filename and tried pushing the log again but that doesnt help how can i overcome this problem

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [December 28, 2015, 11:45pm UTC](https://discuss.elastic.co/t/logstash-startup-completed-and-then-the-system-hangs-logs-are-not-passed-into-elastic-search-how-can-i-overcome-this/38021/2 "2015-12-28T23:45:00Z")

</div>

Please provide more info, what versions are you on, what does your config look like, can you show us what happens when you startup LS.

---

<div class="post-metadata">

### Author: ![Akash\_Katakam](https://avatars.discourse-cdn.com/v4/letter/a/e68b1a/32.png) [@Akash\_Katakam](https://discuss.elastic.co/u/Akash_Katakam)
#### Post date: [December 29, 2015, 8:15am UTC](https://discuss.elastic.co/t/logstash-startup-completed-and-then-the-system-hangs-logs-are-not-passed-into-elastic-search-how-can-i-overcome-this/38021/3 "2015-12-29T08:15:17Z")

</div>

logstash 2.1.1 ES 2.1.1 are the versions of Logstash and Elasticsearch,

input {  
file {  
path =\> "F:\wo\examples\10.log"

```
    start_position => "beginning"
    sincedb_path => "C:\Users\Akash katakam\null"

}

```

}  
filter {  
grok {  
match =\> { "message" =\> "%{TOMCATLOG %{TOMCAT\_DATESTAMP:timestamp} | %{LOGLEVEL:level} | %{JAVACLASS:class} - %{JAVALOGMESSAGE:logmessage}}"}  
}  
if "\_grokparsefailure" in [tags] {  
drop { }  
}  
grok {

```
  match => ["message", "%{TOMCATLOG}", "message", "%{CATALINALOG}"]
}
date {
  match => ["timestamp", "yyyy-MM-dd HH:mm:ss,SSS Z", "MMM dd, yyyy HH:mm:ss a"]
}

```

}

output {  
elasticsearch {

index =\> "splog1"  
}  
stdout {}  
}

 ![](https://us1.discourse-cdn.com/elastic/original/2X/1/19355b3e6a5173a60003f85af28f36412d9a3856.png)

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [December 29, 2015, 9:13am UTC](https://discuss.elastic.co/t/logstash-startup-completed-and-then-the-system-hangs-logs-are-not-passed-into-elastic-search-how-can-i-overcome-this/38021/4 "2015-12-29T09:13:20Z")

</div>

The output you see is expected, LS has started and is waiting for input. The issue is likely `sincedb`, have you tried to delete the file it creates?

Try changing the input;

```auto
input {
  stdin {}
}

```

And then `type F:\wo\examples\10.log > logstash -f ....`

Using `stdin` is the best way to test things like this.

---

<div class="post-metadata">

### Author: ![Akash\_Katakam](https://avatars.discourse-cdn.com/v4/letter/a/e68b1a/32.png) [@Akash\_Katakam](https://discuss.elastic.co/u/Akash_Katakam)
#### Post date: [December 29, 2015, 11:34am UTC](https://discuss.elastic.co/t/logstash-startup-completed-and-then-the-system-hangs-logs-are-not-passed-into-elastic-search-how-can-i-overcome-this/38021/5 "2015-12-29T11:34:53Z")

</div>

i deleted since\_db files and restarted my logstash it is showing the same  
error

---

<div class="post-metadata">

### Author: ![krushnat\_khawale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/krushnat_khawale/32/6652_2.png) [@krushnat\_khawale](https://discuss.elastic.co/u/krushnat_khawale)
#### Post date: [December 29, 2015, 11:49am UTC](https://discuss.elastic.co/t/logstash-startup-completed-and-then-the-system-hangs-logs-are-not-passed-into-elastic-search-how-can-i-overcome-this/38021/6 "2015-12-29T11:49:04Z")

</div>

It is not possibly an error.

In my case, when I use a CSV file to update data, For the first time when execute logstash command it executes and uploads successfully, but for the second and further time it doesn't do that.

So what I have figured out with this is, second or later time as long as there is no change in input(file/source) data is not uploaded. So keep console on and try somehow adding data into your log file, and suddenly data will be uploaded.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:17am UTC](https://discuss.elastic.co/t/logstash-startup-completed-and-then-the-system-hangs-logs-are-not-passed-into-elastic-search-how-can-i-overcome-this/38021/7 "2017-07-06T05:17:13Z")

</div>


