# LS output failed

**URL:** <https://discuss.elastic.co/t/ls-output-failed/123923>\
**Category:** Logstash\
**Created:** [March 14, 2018, 2:26pm UTC](https://discuss.elastic.co/t/ls-output-failed/123923 "2018-03-14T14:26:42Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![wakame](https://avatars.discourse-cdn.com/v4/letter/w/d9b06d/32.png) [@wakame](https://discuss.elastic.co/u/wakame)\
**Post date:** [March 14, 2018, 2:26pm UTC](https://discuss.elastic.co/t/ls-output-failed/123923/1 "2018-03-14T14:26:43Z")

</div>

I'm seeing the following INFO message, the connection to Kafka is lost and I'm unable to connect to it.

`2018-03-14T14:13:02,743][INFO][logstash.outputs.kafka] Sending batch to Kafka failed. Will retry after a delay. {:batch_size=>1, :failures=>1, :sleep=>0.01}`

I've validate that Kafka is up and running.

listeners=PLAINTEXT://IP:9092

this line already exist in Kafka. I could telnet to the Kafka server even though LS is unable to output to it.

ES 5.6.8  
KF 0.10.2.0

---

<div class="post-metadata">

**Author:** ![wakame](https://avatars.discourse-cdn.com/v4/letter/w/d9b06d/32.png) [@wakame](https://discuss.elastic.co/u/wakame)\
**Post date:** [March 14, 2018, 10:35pm UTC](https://discuss.elastic.co/t/ls-output-failed/123923/2 "2018-03-14T22:35:24Z")

</div>

any help would be great?

---

<div class="post-metadata">

**Author:** ![wakame](https://avatars.discourse-cdn.com/v4/letter/w/d9b06d/32.png) [@wakame](https://discuss.elastic.co/u/wakame)\
**Post date:** [March 17, 2018, 4:03am UTC](https://discuss.elastic.co/t/ls-output-failed/123923/3 "2018-03-17T04:03:54Z")

</div>

ran a debug, but got way too many logs. I noticed that it failed at exactly 19:00 three days in a row.

---

<div class="post-metadata">

**Author:** ![yaauie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yaauie/32/23363_2.png) [@yaauie](https://discuss.elastic.co/u/yaauie)\
**Post date:** [March 17, 2018, 4:59am UTC](https://discuss.elastic.co/t/ls-output-failed/123923/4 "2018-03-17T04:59:33Z")

</div>

Does the connection ever resume? Does it require a restart of Logstash?

The timing is suspicious; could a scheduled task be restarting the Kafka process? In a previous job, we had a finnicky Kafka installation that someone "fixed" by killing it daily in cron.

---

<div class="post-metadata">

**Author:** ![wakame](https://avatars.discourse-cdn.com/v4/letter/w/d9b06d/32.png) [@wakame](https://discuss.elastic.co/u/wakame)\
**Post date:** [March 17, 2018, 12:44pm UTC](https://discuss.elastic.co/t/ls-output-failed/123923/5 "2018-03-17T12:44:50Z")

</div>

It doesn’t reconnect. I have to restart Logstash to get the connection going.

---

<div class="post-metadata">

**Author:** ![wakame](https://avatars.discourse-cdn.com/v4/letter/w/d9b06d/32.png) [@wakame](https://discuss.elastic.co/u/wakame)\
**Post date:** [March 20, 2018, 3:59pm UTC](https://discuss.elastic.co/t/ls-output-failed/123923/6 "2018-03-20T15:59:04Z")

</div>

I found something interesting.

If I reboot the box, it will work, but a few hours later, the error is back. But if I restart it using "initctl" it will work fine for a while. What the different in the two starting method?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 17, 2018, 3:59pm UTC](https://discuss.elastic.co/t/ls-output-failed/123923/7 "2018-04-17T15:59:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.