# Still Getting Data after filebeat and logstash are killed **URL:** \ **Category:** Elasticsearch\ **Created:** [April 22, 2019, 6:28am UTC](https://discuss.elastic.co/t/still-getting-data-after-filebeat-and-logstash-are-killed/177802 "2019-04-22T06:28:41Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![shrikantgulia](https://avatars.discourse-cdn.com/v4/letter/s/c68b51/32.png) [@shrikantgulia](https://discuss.elastic.co/u/shrikantgulia)\ **Post date:** [April 22, 2019, 6:28am UTC](https://discuss.elastic.co/t/still-getting-data-after-filebeat-and-logstash-are-killed/177802/1 "2019-04-22T06:28:41Z")
Hello, I am still getting data in elasticsearch index after killing logstash and filebeat and when i am checking the PID of logsatsh and filebeat its showing that both are not working but i am still getting the data Can someone suggest me why is it so. Regards ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [April 22, 2019, 6:49am UTC](https://discuss.elastic.co/t/still-getting-data-after-filebeat-and-logstash-are-killed/177802/2 "2019-04-22T06:49:53Z")
Getting data in which index? ---
**Author:** ![shrikantgulia](https://avatars.discourse-cdn.com/v4/letter/s/c68b51/32.png) [@shrikantgulia](https://discuss.elastic.co/u/shrikantgulia)\ **Post date:** [April 22, 2019, 7:06am UTC](https://discuss.elastic.co/t/still-getting-data-after-filebeat-and-logstash-are-killed/177802/3 "2019-04-22T07:06:17Z")
Hello @dadoonet Thanks for the response I created a config file in logstash and also created a script to run logstash in the backend In the logstash I am getting data from 3 different instances and I am seprating data output to 3 different indices. I applied a loop. Due to certain reasons I had to kill the filebeat and logstash and even I after deleting the registry file in filebeat and I am getting the data and data is getting Indexed in my indices. ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [April 22, 2019, 8:07am UTC](https://discuss.elastic.co/t/still-getting-data-after-filebeat-and-logstash-are-killed/177802/4 "2019-04-22T08:07:09Z")
Can you share an example of a document which has been added after you stopped? Also run the following before stopping and after: ``` GET _cat/indices?v ``` ---
**Author:** ![shrikantgulia](https://avatars.discourse-cdn.com/v4/letter/s/c68b51/32.png) [@shrikantgulia](https://discuss.elastic.co/u/shrikantgulia)\ **Post date:** [April 22, 2019, 8:30am UTC](https://discuss.elastic.co/t/still-getting-data-after-filebeat-and-logstash-are-killed/177802/5 "2019-04-22T08:30:38Z")
Result for the Command GET \_cat/indices?v is: yellow open index\_name 8D\_2\_1NhTLG3GzA0zwTihQ 5 2 8671874 2780751 32.3gb 32.3gb and sample logs which I am getting after stopping beat is: - Table - JSON | @timestamp | | April 22nd 2019, 00:04:31.000 | | --- | --- | --- | | **t** @version | | 1 | | **t** \_id | | rS0tQWoBh0F81AmWuLZK | | **t** \_index | | index\_name | | **#** \_score | | - | | **t** \_type | | doc | | **t** beat.hostname | | sdsdasrm | | **t** beat.name | | \*wfbhidksbcds | | **t** beat.version | | 6.5.2 | | **t** channel\_name | | | | **t** client\_id | | 16 | | created | | April 22nd 2019, 00:04:31.000 | | **t** fields.service\_id | | jaL-IGoBnxDLvH1bMmaP | | **t** host.name | | jfjksddsdas | | **#** id | | 57,182,979 | | **t** tags||beats\_input\_codec\_plain\_applied| ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [April 22, 2019, 7:54pm UTC](https://discuss.elastic.co/t/still-getting-data-after-filebeat-and-logstash-are-killed/177802/6 "2019-04-22T19:54:49Z")
Not sure about what you are meaning. But could you run again the same cat command I pasted before and after stopping. And again after 1 minute. And share all the 3 outputs here. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 20, 2019, 7:54pm UTC](https://discuss.elastic.co/t/still-getting-data-after-filebeat-and-logstash-are-killed/177802/7 "2019-05-20T19:54:49Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.