# Logstash timeout sending messagges to ES cluster

**URL:** <https://discuss.elastic.co/t/logstash-timeout-sending-messagges-to-es-cluster/105188>\
**Category:** Logstash\
**Created:** [October 25, 2017, 8:01am UTC](https://discuss.elastic.co/t/logstash-timeout-sending-messagges-to-es-cluster/105188 "2017-10-25T08:01:29Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![rschirin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rschirin/32/45283_2.png) [@rschirin](https://discuss.elastic.co/u/rschirin)\
**Post date:** [October 25, 2017, 8:01am UTC](https://discuss.elastic.co/t/logstash-timeout-sending-messagges-to-es-cluster/105188/1 "2017-10-25T08:01:29Z")

</div>

Hi,  
currently I have:  
1 LS server  
3 ES nodes (components of a cluster)

I know that I can configure LS to send messages to different ES hosts (by config file). I also undestood that LS sends messages using round robin algorithm to every ES nodes.  
what happen if the first ES node is not alive? LS will forward message automatically to other nodes or will retry?  
taking a look to documentation [here (timeout key)](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-timeout) it seems that will be a retry attempt but I will prefer to forward to other nodes.

out of topic: is the same behavior for Filebeat that sends messages to different LS components?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 25, 2017, 8:48am UTC](https://discuss.elastic.co/t/logstash-timeout-sending-messagges-to-es-cluster/105188/2 "2017-10-25T08:48:37Z")

</div>

> what happen if the first ES node is not alive? LS will forward message automatically to other nodes or will retry?

It'll try sending the request to one of the other ES nodes.

---

<div class="post-metadata">

**Author:** ![rschirin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rschirin/32/45283_2.png) [@rschirin](https://discuss.elastic.co/u/rschirin)\
**Post date:** [October 25, 2017, 8:50am UTC](https://discuss.elastic.co/t/logstash-timeout-sending-messagges-to-es-cluster/105188/3 "2017-10-25T08:50:28Z")

</div>

so, this behavior will be managed using the `timeout` key. correct?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 25, 2017, 9:12am UTC](https://discuss.elastic.co/t/logstash-timeout-sending-messagges-to-es-cluster/105188/4 "2017-10-25T09:12:42Z")

</div>

The timeout option determines how long before Logstash gives up on a request and tries to make a new request (typically to another node if it's a multi-node cluster).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 22, 2017, 9:12am UTC](https://discuss.elastic.co/t/logstash-timeout-sending-messagges-to-es-cluster/105188/5 "2017-11-22T09:12:44Z")

</div>

Closed on November 22, 2017, 9:12am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
