# Logstash Stopped Forwarding Messages to GrayLog After Some Time

**URL:** <https://discuss.elastic.co/t/logstash-stopped-forwarding-messages-to-graylog-after-some-time/1900>\
**Category:** Logstash\
**Created:** [June 4, 2015, 5:34am UTC](https://discuss.elastic.co/t/logstash-stopped-forwarding-messages-to-graylog-after-some-time/1900 "2015-06-04T05:34:58Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Haroon\_Khan](https://avatars.discourse-cdn.com/v4/letter/h/ba9def/32.png) [@Haroon\_Khan](https://discuss.elastic.co/u/Haroon_Khan)\
**Post date:** [June 4, 2015, 5:34am UTC](https://discuss.elastic.co/t/logstash-stopped-forwarding-messages-to-graylog-after-some-time/1900/1 "2015-06-04T05:34:58Z")

</div>

Hi guys

I have four servers from which i am sending the logs directly to my Gray log server. My Conf file looks like the following.

```
input {

file {
	type => "apache-localhost"
	path => "/var/log/tomcat8/localhost_access_log.txt"
	start_position => "beginning"
}

file {
	type => "apiusage"
	path => "/var/log/tomcat8/APIusage.log"
	start_position => "beginning"
}

file {
	type => "caching"
	path => "/var/log/tomcat8/caching.log"
	start_position => "beginning"
}

file {
	type => "dispatch"
	path => "/var/log/tomcat8/dispatches.log"
	start_position => "beginning"
}

file {
	type => "facade-exceptions"
	path => "/var/log/tomcat8/FacadeException.log"
	start_position => "beginning"
}

```

}

For a good period of time the logstash server forwards the messages properly but it stops after some time. I even restarted the logstash process and also my GrayLog2 server but it dint work. Can someone please help on this.

Regards  
Haroon

---

<div class="post-metadata">

**Author:** ![jrgns](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jrgns/32/640_2.png) [@jrgns](https://discuss.elastic.co/u/jrgns)\
**Post date:** [June 4, 2015, 8:25am UTC](https://discuss.elastic.co/t/logstash-stopped-forwarding-messages-to-graylog-after-some-time/1900/2 "2015-06-04T08:25:30Z")

</div>

Hey

Is there anything in the Logstash or greylog logs that will give an indication of what's going on? If there's nothing in the Logstash logs, you can try to enable debugging output (`--debug`) to get more information.

J

---

<div class="post-metadata">

**Author:** ![Haroon\_Khan](https://avatars.discourse-cdn.com/v4/letter/h/ba9def/32.png) [@Haroon\_Khan](https://discuss.elastic.co/u/Haroon_Khan)\
**Post date:** [June 4, 2015, 8:40am UTC](https://discuss.elastic.co/t/logstash-stopped-forwarding-messages-to-graylog-after-some-time/1900/3 "2015-06-04T08:40:19Z")

</div>

Nop there is nothing i have restarted my logstash multiple times with the intervals of about 5 mins, then i restarted logstash after half an hour which did the trick for me. But I dont know the actual reason behind this behavior. I am continuously monitoring my graylog inputs and they are behaving fine.

---

<div class="post-metadata">

**Author:** ![Haroon\_Khan](https://avatars.discourse-cdn.com/v4/letter/h/ba9def/32.png) [@Haroon\_Khan](https://discuss.elastic.co/u/Haroon_Khan)\
**Post date:** [June 4, 2015, 12:26pm UTC](https://discuss.elastic.co/t/logstash-stopped-forwarding-messages-to-graylog-after-some-time/1900/4 "2015-06-04T12:26:15Z")

</div>

I have also observed that if there is a CPU Utilization Spike, the logstash sort of freezes and stops sending the logs to the graylog2 server.. Thoughts Everyone??

Haroon

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:38am UTC](https://discuss.elastic.co/t/logstash-stopped-forwarding-messages-to-graylog-after-some-time/1900/5 "2017-07-06T05:38:34Z")

</div>