Logstash stops automatically with an error

Elastic Stack Logstash
1

Hi Experts,

My logstash1.5.4 stops working with the flowing error . Please help me to resolve and understand this issue .

{:timestamp=>"2016-03-08T17:01:33.421000+0530", :message=>"Failed to flush outgoing items", :outgoing_count=>1, :exception=>"Manticore::ClientProtocolException", :backtrace=>["/opt/ls/logstash-1.5.4/vendor/bundle/jruby/1.9/gems/manticore-0.4.4-java/lib/manticore/response.rb:35:ininitialize'", "org/jruby/RubyProc.java:271:in call'", "/opt/ls/logstash-1.5.4/vendor/bundle/jruby/1.9/gems/manticore-0.4.4-java/lib/manticore/response.rb:70:incall'", "/opt/ls/logstash-1.5.4/vendor/bundle/jruby/1.9/gems/manticore-0.4.4-java/lib/manticore/response.rb:245:in call_once'", "/opt/ls/logstash-1.5.4/vendor/bundle/jruby/1.9/gems/manticore-0.4.4-java/lib/manticore/response.rb:148:incode'", "/opt/ls/logstash-1.5.4/vendor/bundle/jruby/1.9/gems/elasticsearch-transport-1.0.12/lib/elasticsearch/transport/transport/http/manticore.rb:71:in perform_request'", "org/jruby/RubyProc.java:271:incall'", "/opt/ls/logstash-1.5.4/vendor/bundle/jruby/1.9/gems/elasticsearch-transport-1.0.12/lib/elasticsearch/transport/transport/base.rb:190:in perform_request'", "/opt/ls/logstash-1.5.4/vendor/bundle/jruby/1.9/gems/elasticsearch-transport-1.0.12/lib/elasticsearch/transport/transport/http/manticore.rb:54:inperform_request'", "/opt/ls/logstash-1.5.4/vendor/bundle/jruby/1.9/gems/elasticsearch-transport-1.0.12/lib/elasticsearch/transport/client.rb:119:in perform_request'", "/opt/ls/logstash-1.5.4/vendor/bundle/jruby/1.9/gems/elasticsearch-api-1.0.12/lib/elasticsearch/api/actions/bulk.rb:80:inbulk'", "/opt/ls/logstash-1.5.4/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-1.0.7-java/lib/logstash/outputs/elasticsearch/protocol.rb:104:in bulk'", "/opt/ls/logstash-1.5.4/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-1.0.7-java/lib/logstash/outputs/elasticsearch.rb:542:insubmit'", "/opt/ls/logstash-1.5.4/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-1.0.7-java/lib/logstash/outputs/elasticsearch.rb:541:in submit'", "/opt/ls/logstash-1.5.4/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-1.0.7-java/lib/logstash/outputs/elasticsearch.rb:566:inflush'", "/opt/ls/logstash-1.5.4/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-1.0.7-java/lib/logstash/outputs/elasticsearch.rb:565:in flush'", "/opt/ls/logstash-1.5.4/vendor/bundle/jruby/1.9/gems/stud-0.0.21/lib/stud/buffer.rb:219:inbuffer_flush'", "org/jruby/RubyHash.java:1341:in each'", "/opt/ls/logstash-1.5.4/vendor/bundle/jruby/1.9/gems/stud-0.0.21/lib/stud/buffer.rb:216:inbuffer_flush'", "/opt/ls/logstash-1.5.4/vendor/bundle/jruby/1.9/gems/stud-0.0.21/lib/stud/buffer.rb:193:in buffer_flush'", "/opt/ls/logstash-1.5.4/vendor/bundle/jruby/1.9/gems/stud-0.0.21/lib/stud/buffer.rb:159:inbuffer_receive'", "/opt/ls/logstash-1.5.4/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-1.0.7-java/lib/logstash/outputs/elasticsearch.rb:531:in receive'", "/opt/ls/logstash-1.5.4/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.4-java/lib/logstash/outputs/base.logstash@ETAGSOCVPELKLS01:/opt/ls/logstash-1.5.4/bin$

Thanks
VG

2

Please show your Logstash configuration.

3

Here is my config
input {
file {
type => "cef"
path => "home/*.log"
start_position => "beginning"
sincedb_path => "home/sincedb"
}
}
filter {
.......................
.....................
.................
}
output {
if [type] == "cef" {
elasticsearch {
protocol => "http"
action => "index"
host => "hostname:20002"
index => "cef-%{[@metadata][now]}"
workers => 4
}
}
}

4

Okay, nothing unusual there. You haven't enabled HTTPS on port 9200 have you?

5

Hmm, So I am using another port , so it is not 9200 and it is open . LS was working fine from last 4 days , but it stopped today with this error . So is it something related to port ? I mean we get this error when communication breaks ?

6

You're not using port 9200? Then you have to configure Logstash accordingly.

7

@magnusbaeck Sorry I did not mention , so in the output plugin i am using host => "host:20002", So 20002 is the port I am hitting to .So what could be the problem ?