# Missing log lines filebeat to logstash

**URL:** <https://discuss.elastic.co/t/missing-log-lines-filebeat-to-logstash/216255>\
**Category:** Logstash\
**Created:** [January 23, 2020, 1:46pm UTC](https://discuss.elastic.co/t/missing-log-lines-filebeat-to-logstash/216255 "2020-01-23T13:46:37Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![danielwind83](https://avatars.discourse-cdn.com/v4/letter/d/49beb7/32.png) [@danielwind83](https://discuss.elastic.co/u/danielwind83)\
**Post date:** [January 23, 2020, 1:46pm UTC](https://discuss.elastic.co/t/missing-log-lines-filebeat-to-logstash/216255/1 "2020-01-23T13:46:37Z")

</div>

Hi All,

We are running:  
Kibana 7.4.0  
Elastic 7.4.0  
Logstash 7.4.0  
Filebeat (33 instances) 6.8.3

We found out we were missing some log lines from two different filebeat clients at different times. After some searching, the only thing we were able to find were errors in Logstash, every 30 sec about:  
[2020-01-23T14:06:28,817][INFO][org.logstash.beats.BeatsHandler] [local: 0.0.0.0:5044, remote: 172..0.57:48228] Handling exception: javax.net.ssl.SSLHandshakeException: error:10000412:SSL routines:OPENSSL\_internal:SSLV3\_ALERT\_BAD\_CERTIFICATE  
[2020-01-23T14:06:28,818][WARN][io.netty.channel.DefaultChannelPipeline] An exceptionCaught() event was fired, and it reached at the tail of the pipeline. It usually means the last handler in the pipeline did not handle the exception.  
io.netty.handler.codec.DecoderException: javax.net.ssl.SSLHandshakeException: error:10000412:SSL routines:OPENSSL\_internal:SSLV3\_ALERT\_BAD\_CERTIFICATE

After looking on the remote host we found out that this host had a old proces with a old expired certificate. After killing and starting again the SSL errors were gone on logstash.

The real question is:  
Is it possible that when the client with the expired certificate tries to connect the SSL engine breaks and shuts the connection from another client so that some lines are missing from the second client?

Regards, Daniel

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 20, 2020, 1:46pm UTC](https://discuss.elastic.co/t/missing-log-lines-filebeat-to-logstash/216255/2 "2020-02-20T13:46:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.