# Rebooting Logstash VM

**URL:** <https://discuss.elastic.co/t/rebooting-logstash-vm/297904>\
**Category:** Logstash\
**Created:** [February 22, 2022, 1:39pm UTC](https://discuss.elastic.co/t/rebooting-logstash-vm/297904 "2022-02-22T13:39:20Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Cosmus\_Wright](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cosmus_wright/32/100428_2.png) [@Cosmus\_Wright](https://discuss.elastic.co/u/Cosmus_Wright)\
**Post date:** [February 22, 2022, 1:39pm UTC](https://discuss.elastic.co/t/rebooting-logstash-vm/297904/1 "2022-02-22T13:39:20Z")

</div>

Hello!

If I stop the Logstash service and reboot the the VM, will any incoming events during that time be lost?  
Currently we have an Azure EventHub that sends the events to Logstash and then onwards to Elasticsearch.

I was not able to find any best practice information about restarting Logstash so any documentation would be very welcome!

Thanks in advance!

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [February 22, 2022, 1:50pm UTC](https://discuss.elastic.co/t/rebooting-logstash-vm/297904/2 "2022-02-22T13:50:20Z")

</div>

It depends on your inputs.

If you are using the azure eventhub input, then when Logstash will resume from the last offset it consumed before the restart.

---

<div class="post-metadata">

**Author:** ![Cosmus\_Wright](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cosmus_wright/32/100428_2.png) [@Cosmus\_Wright](https://discuss.elastic.co/u/Cosmus_Wright)\
**Post date:** [February 22, 2022, 2:11pm UTC](https://discuss.elastic.co/t/rebooting-logstash-vm/297904/3 "2022-02-22T14:11:30Z")

</div>

Thank you for the information.

Would you say best practice is then to simply stop logstash.service, reboot the VM and start logstash.service again afterwards?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 22, 2022, 2:12pm UTC](https://discuss.elastic.co/t/rebooting-logstash-vm/297904/4 "2022-03-22T14:12:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.