# Response from logstash to pause filebeat?

**URL:** <https://discuss.elastic.co/t/response-from-logstash-to-pause-filebeat/114880>\
**Category:** Beats\
**Created:** [January 10, 2018, 1:33pm UTC](https://discuss.elastic.co/t/response-from-logstash-to-pause-filebeat/114880 "2018-01-10T13:33:56Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![bigbird7821](https://avatars.discourse-cdn.com/v4/letter/b/0ea827/32.png) [@bigbird7821](https://discuss.elastic.co/u/bigbird7821)\
**Post date:** [January 10, 2018, 1:33pm UTC](https://discuss.elastic.co/t/response-from-logstash-to-pause-filebeat/114880/1 "2018-01-10T13:33:56Z")

</div>

I have a bunch of filebeat servers pointing to the logstash cluster via a service discovery endpoint (via consul). When I bounce the elasticsearch cluster, I usually start by stopping the filebeats, then the logstash agents, then elasticsearch; then I start elasticsearch, logstash, filebeat.

I won't be able to script the shutdown of filebeat (via service shutdown filebeat), but nevertheless I want to be able to pause it's prospecting while I bring the logstash/elasticsearch down and up.

Is there a way for me to have logstash send a "pause" response to filebeat? I don't want any data to be lost.

Thanks,  
Gavin.

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [January 11, 2018, 12:34pm UTC](https://discuss.elastic.co/t/response-from-logstash-to-pause-filebeat/114880/2 "2018-01-11T12:34:31Z")

</div>

This kind of signal does not exist.

Beats will automatically try to reconnect if the remote becomes unavailable. As you use consul the Logstash hostnames won't change, so you are good to go. When using logstash set `output.logstash.max_retries: -1`. This enables infinite retry for all events. Filebeat/Winlogbeat already use infinite retry by default, no matter the `max_retries` setting (can not be disabled).

Why filebeat is probing for logstash to become available, the internal queues will fill up and create back-pressure. No data is collected until logstash becomes available again.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 31, 2018, 1:33pm UTC](https://discuss.elastic.co/t/response-from-logstash-to-pause-filebeat/114880/3 "2018-01-31T13:33:56Z")

</div>

This topic was automatically closed after 21 days. New replies are no longer allowed.