# Logstash stop sending the logs to the ElasticSearch **URL:** \ **Category:** Logstash\ **Created:** [January 5, 2016, 11:12am UTC](https://discuss.elastic.co/t/logstash-stop-sending-the-logs-to-the-elasticsearch/38393 "2016-01-05T11:12:17Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![maxcherednik](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/maxcherednik/32/590_2.png) [@maxcherednik](https://discuss.elastic.co/u/maxcherednik)\ **Post date:** [January 5, 2016, 11:12am UTC](https://discuss.elastic.co/t/logstash-stop-sending-the-logs-to-the-elasticsearch/38393/1 "2016-01-05T11:12:17Z")
Version: logstash-2.1.1 After elasticsearch was out for a while and the logstash generates error like this: {:timestamp=\>"2015-12-25T17:32:47.451000+0200", :message=\>"Attempted to send a bulk request to Elasticsearch configured at '["[http://elasticsearch:9200/](http://elasticsearch:9200/)"]', but Elasticsearch appears to be unreachable or down!", :client\_config=\>{:hosts=\>["[http://elasticseach:9200/](http://elasticseach:9200/)"], :ssl=\>nil, :transport\_options=\>{:socket\_timeout=\>0, :request\_timeout=\>0, :proxy=\>nil, :ssl=\>{}}, :transport\_class=\>Elasticsearch::Transport::Transport::HTTP::Manticore, :logger=\>nil, :tracer=\>nil, :reload\_connections=\>false, :retry\_on\_failure=\>false, :reload\_on\_failure=\>false, :randomize\_hosts=\>false}, :error\_message=\>"Connection refused: connect", :class=\>"Manticore::SocketException", :level=\>:error} And nothing happens afterwards. Such a basic scenario. Very disappointing ☹ ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [January 5, 2016, 1:36pm UTC](https://discuss.elastic.co/t/logstash-stop-sending-the-logs-to-the-elasticsearch/38393/2 "2016-01-05T13:36:04Z")
So... `curl http://elasticseach:9200/`worked at 17:32 yet Logstash still wasn't able to connect? ---
**Author:** ![maxcherednik](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/maxcherednik/32/590_2.png) [@maxcherednik](https://discuss.elastic.co/u/maxcherednik)\ **Post date:** [January 5, 2016, 1:43pm UTC](https://discuss.elastic.co/t/logstash-stop-sending-the-logs-to-the-elasticsearch/38393/3 "2016-01-05T13:43:39Z")
Yep, we restarted the elasticsearch machine and it was up and running afterwards. In the log file of the logstash I have seen several attempts to write logs to the ElasticSearch and then silence. Actually we faced a couple of different situations: 1. ElasticSearch machine restart 2. ElasticSearch service restart ---
**Author:** ![aderenbach](https://avatars.discourse-cdn.com/v4/letter/a/c0e974/32.png) [@aderenbach](https://discuss.elastic.co/u/aderenbach)\ **Post date:** [January 11, 2016, 4:21pm UTC](https://discuss.elastic.co/t/logstash-stop-sending-the-logs-to-the-elasticsearch/38393/4 "2016-01-11T16:21:01Z")
Same problem here. Actually the Elasticsearch Instances are running both since 3 days, but logstash stops working. On different maschines at different time. We had on ES Cluster for 3 environments In the acutal setup the application which logs are captured is not producing logs all the time. As there are dev and test servers it is possible that there are no logs for hours. Yet I am not sure if this has a relation. Logstash is able to reconnect after it is killed (-9) and restarted. Elasticsearch Version: 2.1.1 Logstash Version: logstash-2.1.1-1.noarch (RPM) ---
**Author:** ![djvidov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/djvidov/32/6135_2.png) [@djvidov](https://discuss.elastic.co/u/djvidov)\ **Post date:** [February 10, 2016, 2:48pm UTC](https://discuss.elastic.co/t/logstash-stop-sending-the-logs-to-the-elasticsearch/38393/5 "2016-02-10T14:48:12Z")
Hello, I think I have the same problem. I use filebeat as log provider ( this is installed on windows server), then logstash receive these logs and make them as json and save them to elasticsearch. after few days, 2-7, it stops with this error message (logging is in debug). ELK is installed into redhat server. Every time after I start logstash everything works well. Any idea about this issue? ``` {:timestamp=>"2016-02-09T11:37:11.055000+0200", :message=>"Flushing buffer at interval", :instance=>"#, @max_size=500, @operations_lock=#, @submit_proc=#, @logger=#, @metrics={}, @channel=#>, @subscriber_lock=#, @level=:debug, @subscribers={12450=>#, @lock=#>}, @data={}>, @last_flush=2016-02-09 11:37:09 +0200, @flush_interval=1, @stopping=#, @buffer=[[\"index\", {:_id=>nil, :_index=>\"logstash-2016.02.09\", :_type=>\"log\", :_routing=>nil}, #\"st\", \"type\"=>\"log\"}, @lut={\"[beat]\"=>[{\"beat\"=>\"st\", \"type\"=>\"log\"}, \"beat\"]}>, @cancelled=false, @data={\"LogLevel\"=>\"INFO\", \"StartTime\"=>\"2016-02-09 11:33:59.2459409\", \"ExecutionTime\"=>0, \"CallingMethod\"=>\"InvokeMethod\", \"Correlation\"=>{\"CorrelationId\"=>\"10bd8e73-5975-402f-a0b8-bd5b1fec08fb\", \"SequenceNo\"=>1}, \"Info\"=>{\"Id\"=>1, \"Name\"=>\"GetCurrentInstance\", \"AppGuid\"=>\"93d25489-d02b-4ecc-89e9-6f97e57c3d0c\"}, \"Inputs\"=>\"[]\", \"@version\"=>\"1\", \"@timestamp\"=>\"2016-02-09T09:33:59.459Z\", \"beat\"=>{\"hostname\"=>\"BUHRAPPST01\", \"name\"=>\"BUHRAPPST01\"}, \"count\"=>1, \"fields\"=>nil, \"input_type\"=>\"log\", \"offset\"=>1734196, \"source\"=>\"D:\\\\Logs\\\\Plat_20160209-11.log\", \"type\"=>\"log\"}, @metadata={\"beat\"=>\"st\", \"type\"=>\"log\"}, @accessors=#\"INFO\", ... ``` ---
**Author:** ![djvidov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/djvidov/32/6135_2.png) [@djvidov](https://discuss.elastic.co/u/djvidov)\ **Post date:** [February 10, 2016, 2:48pm UTC](https://discuss.elastic.co/t/logstash-stop-sending-the-logs-to-the-elasticsearch/38393/6 "2016-02-10T14:48:37Z")
part 2 of error: {:timestamp=\>"2016-02-09T11:37:11.136000+0200", :message=\>"Attempted to send a bulk request to Elasticsearch configured at '["[https://10.98.25.182:9200/](https://10.98.25.182:9200/)"]', but an error occurred and it failed! Are you sure you can reach elasticsearch from this machine using the configuration provided?", :client\_config=\>{:hosts=\>["[https://10.98.25.182:9200/](https://10.98.25.182:9200/)"], :ssl=\>{:ca\_file=\>"/etc/logstash/cacert.pem", :verify=\>false}, :transport\_options=\>{:socket\_timeout=\>0, :request\_timeout=\>0, :proxy=\>nil, :ssl=\>{:ca\_file=\>"/etc/logstash/cacert.pem", :verify=\>false}}, :transport\_class=\>Elasticsearch::Transport::Transport::HTTP::Manticore, :headers=\>{"Authorization"=\>"Basic bG9nc3Rhc2g6bG9nc3Rhc2gxMjMh"}, :level=\>:debug, :logger=\>nil, :tracer=\>nil, :reload\_connections=\>false, :retry\_on\_failure=\>false, :reload\_on\_failure=\>false, :randomize\_hosts=\>false}, :error\_message=\>"SSL peer shut down incorrectly", :error\_class=\>"Manticore::ClientProtocolException", :backtrace=\>["/opt/logstash/vendor/bundle/jruby/1.9/gems/manticore-0.4.4-java/lib/manticore/response.rb:35:in `initialize'", "org/jruby/RubyProc.java:271:in`call'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/manticore-0.4.4-java/lib/manticore/response.rb:70:in `call'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/manticore-0.4.4-java/lib/manticore/response.rb:245:in`call\_once'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/manticore-0.4.4-java/lib/manticore/response.rb:148:in `code'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/elasticsearch-transport-1.0.14/lib/elasticsearch/transport/transport/http/manticore.rb:71:in`perform\_request'", "org/jruby/RubyProc.java:271:in `call'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/elasticsearch-transport-1.0.14/lib/elasticsearch/transport/transport/base.rb:191:in`perform\_request'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/elasticsearch-transport-1.0.14/lib/elasticsearch/transport/transport/http/manticore.rb:54:in `perform_request'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/elasticsearch-transport-1.0.14/lib/elasticsearch/transport/client.rb:119:in`perform\_request'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/elasticsearch-api-1.0.14/lib/elasticsearch/api/actions/bulk.rb:87:in `bulk'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-2.1.4-java/lib/logstash/outputs/elasticsearch/http_client.rb:57:in`bulk'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-2.1.4-java/lib/logstash/outputs/elasticsearch/common.rb:140:in `safe_bulk'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-2.1.4-java/lib/logstash/outputs/elasticsearch/common.rb:83:in`submit'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-2.1.4-java/lib/logstash/outputs/elasticsearch/common.rb:69:in `retrying_submit'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-2.1.4-java/lib/logstash/outputs/elasticsearch/common.rb:55:in`setup\_buffer\_and\_handler'", "org/jruby/RubyProc.java:271:in `call'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-2.1.4-java/lib/logstash/outputs/elasticsearch/buffer.rb:109:in`flush\_unsafe'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-2.1.4-java/lib/logstash/outputs/elasticsearch/buffer.rb:93:in `interval_flush'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-2.1.4-java/lib/logstash/outputs/elasticsearch/buffer.rb:82:in`spawn\_interval\_flusher'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-2.1.4-java/lib/logstash/outputs/elasticsearch/buffer.rb:63:in `synchronize'", "org/jruby/ext/thread/Mutex.java:149:in`synchronize'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-2.1.4-java/lib/logstash/outputs/elasticsearch/buffer.rb:63:in `synchronize'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-2.1.4-java/lib/logstash/outputs/elasticsearch/buffer.rb:82:in`spawn\_interval\_flusher'", "org/jruby/RubyKernel.java:1479:in `loop'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-2.1.4-java/lib/logstash/outputs/elasticsearch/buffer.rb:79:in`spawn\_interval\_flusher'"], :level=\>:error, :file=\>"logstash/outputs/elasticsearch/common.rb", :line=\>"159", :method=\>"safe\_bulk"} {:timestamp=\>"2016-02-09T11:37:11.142000+0200", :message=\>"Failed actions for last bad bulk request!", :actions=\>[["index", {:\_id=\>nil, :\_index=\>"logstash-2016.02.09", :\_type=\>"log", :\_routing=\>nil}, #\"st", "type"=\>"log"}, @lut={"[beat]"=\>[{"beat"=\>"st", "type"=\>"log"}, "beat"]}\>, @cancelled=false, @data={"LogLevel"=\>"INFO", ... ---
**Author:** ![aderenbach](https://avatars.discourse-cdn.com/v4/letter/a/c0e974/32.png) [@aderenbach](https://discuss.elastic.co/u/aderenbach)\ **Post date:** [February 10, 2016, 3:37pm UTC](https://discuss.elastic.co/t/logstash-stop-sending-the-logs-to-the-elasticsearch/38393/7 "2016-02-10T15:37:35Z")
We already faced out, that the connection is closed on TCP level by the firewall after a long time of inactivity. But we still have no idea why the connection is not re-established. On a vagrant test linux box I tryed to reproduce it, but here the connection was opend again, after the firewall cut it down. ---
**Author:** ![caoping](https://avatars.discourse-cdn.com/v4/letter/c/aca169/32.png) [@caoping](https://discuss.elastic.co/u/caoping)\ **Post date:** [October 11, 2016, 2:49am UTC](https://discuss.elastic.co/t/logstash-stop-sending-the-logs-to-the-elasticsearch/38393/8 "2016-10-11T02:49:36Z")
Hi, I also ran into this issue after several hours running of logstash. My Logstash is 2.3.4, and Elasticsearch is 2.3.5. Everything works well again after restarting logstash. Any suggestions on that? Thanks a lot! ---
**Author:** ![teebu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/teebu/32/10119_2.png) [@teebu](https://discuss.elastic.co/u/teebu)\ **Post date:** [December 2, 2016, 8:05pm UTC](https://discuss.elastic.co/t/logstash-stop-sending-the-logs-to-the-elasticsearch/38393/9 "2016-12-02T20:05:23Z")
I think im experiencing this. If I restart ES, Logstash throws `:message=>"Got error to send bulk of actions: Connection refused", :level=>:error}` But when ES comes back, logstash does not resume. ---
**Author:** ![Selle](https://avatars.discourse-cdn.com/v4/letter/s/a87d85/32.png) [@Selle](https://discuss.elastic.co/u/Selle)\ **Post date:** [December 5, 2016, 12:27pm UTC](https://discuss.elastic.co/t/logstash-stop-sending-the-logs-to-the-elasticsearch/38393/10 "2016-12-05T12:27:57Z")
Hi I've experience similar behaviour. My findings was documented here: > Hope it helps //Rickard ---
**Author:** ![teebu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/teebu/32/10119_2.png) [@teebu](https://discuss.elastic.co/u/teebu)\ **Post date:** [December 5, 2016, 9:06pm UTC](https://discuss.elastic.co/t/logstash-stop-sending-the-logs-to-the-elasticsearch/38393/11 "2016-12-05T21:06:25Z")
Thanks Rickard, I'm using LS1.5, so I still have to deal with some of this stuff, I added: ```auto max_retries => "60" # default 3 retry_max_interval => "10" ``` I guess after a few retries, it gives up. This might give it enough time for ES to restart and continue going. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 4:29am UTC](https://discuss.elastic.co/t/logstash-stop-sending-the-logs-to-the-elasticsearch/38393/12 "2017-07-06T04:29:59Z")