# Logstash stops elasticsearch

**URL:** <https://discuss.elastic.co/t/logstash-stops-elasticsearch/323017>\
**Category:** Elasticsearch\
**Created:** [January 12, 2023, 11:20am UTC](https://discuss.elastic.co/t/logstash-stops-elasticsearch/323017 "2023-01-12T11:20:41Z")\
**Posts on this page:** 9\
**Page:** 2

<div class="post-metadata">

**Author:** ![bas\_kos](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bas_kos/32/97430_2.png) [@bas\_kos](https://discuss.elastic.co/u/bas_kos)\
**Post date:** [January 17, 2023, 9:34am UTC](https://discuss.elastic.co/t/logstash-stops-elasticsearch/323017/21 "2023-01-17T09:34:18Z")

</div>

My logs after the start logstash  
[elasticsearch.log](https://drive.google.com/file/d/1QvBxVxUH-PVWKeiI7EYRVbVrSo6Fduua/view?usp=share_link)  
[logstash-plain.log](https://drive.google.com/file/d/1Dh6UMPhfRvTBygH_yvQ-x1WwoKdZc_p8/view?usp=share_link)  
[gc.log](https://drive.google.com/file/d/1-kJAL4CAwZpm0XcB77FRFyx3oTONfAiE/view?usp=share_link)

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [January 17, 2023, 9:39am UTC](https://discuss.elastic.co/t/logstash-stops-elasticsearch/323017/22 "2023-01-17T09:39:20Z")

</div>

> [2023-01-17T11:12:34,472][INFO][logstash.config.source.local.configpathloader] No config files found in path {:path=\>"/etc/logstash/conf.d/\*.conf"}

You don't have any file there. Save the sample from above as "/etc/logstash/conf.d/test.conf"and restart LS.

---

<div class="post-metadata">

**Author:** ![bas\_kos](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bas_kos/32/97430_2.png) [@bas\_kos](https://discuss.elastic.co/u/bas_kos)\
**Post date:** [January 17, 2023, 11:56am UTC](https://discuss.elastic.co/t/logstash-stops-elasticsearch/323017/23 "2023-01-17T11:56:46Z")

</div>

I did it. The result is the same. I reloaded the logs. The links are the same.

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [January 17, 2023, 12:33pm UTC](https://discuss.elastic.co/t/logstash-stops-elasticsearch/323017/24 "2023-01-17T12:33:32Z")

</div>

Can you:  
` ls -l /etc/logstash/conf.d/`

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [January 17, 2023, 12:56pm UTC](https://discuss.elastic.co/t/logstash-stops-elasticsearch/323017/25 "2023-01-17T12:56:03Z")

</div>

> [@bas\_kos](#):
>
> `Jan 17 11:04:54 log systemd[1]: elasticsearch.service: A process of this unit has been killed by the OOM killer.`

You need to increase the memory of your server or set the memory for both logstash and elasticsearch in their respective `jvm.options` file.

For logstash you need to edit the file `/etc/logstash/jvm.options`, find the part where you have `Xmx` and `Xms` configuration and set the memory there.

You may use:

```auto
-Xms1g
-Xmx1g

```

For Elasticsearch you need to add a new file in the path `/etc/elasticsearch/jvm.options.d/` with the following content.

```auto
-Xms1g
-Xmx1g

```

This will make both Logstash and Elasticsearch use only 1 GB of RAM.

---

<div class="post-metadata">

**Author:** ![bas\_kos](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bas_kos/32/97430_2.png) [@bas\_kos](https://discuss.elastic.co/u/bas_kos)\
**Post date:** [January 17, 2023, 12:59pm UTC](https://discuss.elastic.co/t/logstash-stops-elasticsearch/323017/26 "2023-01-17T12:59:21Z")

</div>

total 4  
-rw-r--r-- 1 root root 299 Jan 17 12:30 config.conf

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [January 17, 2023, 1:18pm UTC](https://discuss.elastic.co/t/logstash-stops-elasticsearch/323017/27 "2023-01-17T13:18:49Z")

</div>

Your error is that your server does not have enough memory to run all the stack without you fixing the memory of both Elasticsearch and Logstash.

You do not have any config error, logstash can load your config as you can see in the following lines:

```auto
[2023-01-17T13:21:02,883][INFO][logstash.javapipeline][main] Starting pipeline {:pipeline_id=>"main", "pipeline.workers"=>4, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>50, "pipeline.max_inflight"=>500, "pipeline.sources"=>["/etc/logstash/conf.d/config.conf"], :thread=>"#<Thread:0xa3d9824 run>"}
[2023-01-17T13:21:03,485][INFO][logstash.javapipeline][main] Pipeline Java execution initialization time {"seconds"=>0.6}
[2023-01-17T13:21:03,523][INFO][logstash.inputs.beats][main] Starting input listener {:address=>"0.0.0.0:5044"}
[2023-01-17T13:21:03,543][INFO][logstash.javapipeline][main] Pipeline started {"pipeline.id"=>"main"}

```

But it cannot run connect to Elasticsearch because elasticsearch is not running:

```auto
[2023-01-17T13:21:07,822][WARN][logstash.outputs.elasticsearch][main] Attempted to resurrect connection to dead ES instance, but got an error {:url=>"https://elastic:xxxxxx@127.0.0.1:9200/", :exception=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :message=>"Elasticsearch Unreachable: [https://127.0.0.1:9200/][Manticore::SocketException] Connect to 127.0.0.1:9200 [/127.0.0.1] failed: Connection refused"}
[2023-01-17T13:21:12,827][INFO][logstash.outputs.elasticsearch][main] Failed to perform request {:message=>"Connect to 127.0.0.1:9200 [/127.0.0.1] failed: Connection refused", :exception=>Manticore::SocketException, :cause=>#<Java::OrgApacheHttpConn::HttpHostConnectException: Connect to 127.0.0.1:9200 [/127.0.0.1] failed: Connection refused>}

```

Your system is killing your Elasticsearch process, as you can see in the log below:

> Jan 17 11:04:54 log systemd[1]: elasticsearch.service: A process of this unit has been killed by the **OOM killer**.  
> Jan 17 11:04:54 log systemd[1]: elasticsearch.service: Failed with result ' **oom-kill**'.

Try to do what I explained in the previous answer, fix the memory for Elasticsearch and Logstash and check if both services will run.

---

<div class="post-metadata">

**Author:** ![bas\_kos](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bas_kos/32/97430_2.png) [@bas\_kos](https://discuss.elastic.co/u/bas_kos)\
**Post date:** [January 19, 2023, 7:17am UTC](https://discuss.elastic.co/t/logstash-stops-elasticsearch/323017/28 "2023-01-19T07:17:45Z")

</div>

Thanks.  
I copy /etc/elasticsearch/jvm.options to /etc/elasticsearch/jvm.options.d/ and add  
-Xms1g  
-Xmx1g  
into this file  
elasticsearch not stop but when I run systemctl status elasticsearch.service I see  
log systemd-entrypoint[971]: [0.002s][warning][logging] Output options for existing outputs are ignored.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 16, 2023, 7:18am UTC](https://discuss.elastic.co/t/logstash-stops-elasticsearch/323017/29 "2023-02-16T07:18:14Z")

</div>

Closed on February 16, 2023, 7:18am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

[Previous page](https://discuss.elastic.co/t/logstash-stops-elasticsearch/323017.md?page=1)