# Strange behavior with ELK setup **URL:** \ **Category:** Logstash\ **Created:** [July 7, 2017, 8:59pm UTC](https://discuss.elastic.co/t/strange-behavior-with-elk-setup/92332 "2017-07-07T20:59:12Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![rahul.dhammy](https://avatars.discourse-cdn.com/v4/letter/r/e79b87/32.png) [@rahul.dhammy](https://discuss.elastic.co/u/rahul.dhammy)\ **Post date:** [July 7, 2017, 8:59pm UTC](https://discuss.elastic.co/t/strange-behavior-with-elk-setup/92332/1 "2017-07-07T20:59:13Z")
Here is the setup for my ELK setup. I have about 3 data shippers running on different boxes which ships the log files to central logstash server. The logstash server parses these events and outputs it to Kibana. I have been trying so hard and not able to get to the bottom of the problem. With this whole setup I see dateParse failures in logstash config. But if I change the logstash output to files instead of elastic server I do not see dateParse failures. I can also confirm that these parsing failures are coming from multliline events in my log files (the ones with error stack trace). The surprising thing is if I process these multiline files individually, it works fine. Not sure how I can resolve this? I have also increased my multiline interval. It has brought down error count but not resolved all the errors. I am falling short of ideas now. input { beats { port =\> "5043" codec =\> multiline { pattern =\> "^\s\*[0-9]{4}[-][0-9]{1,2}[-][0-9]{1,2}" what =\> "previous" negate =\> true auto\_flush\_interval =\> 120 } } } ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [July 7, 2017, 10:58pm UTC](https://discuss.elastic.co/t/strange-behavior-with-elk-setup/92332/2 "2017-07-07T22:58:18Z")
Just a heads up, we changed the name from ELK to Elastic Stack, cause otherwise beats gets left out and feels lonely 😉 Are you using beats as the shippers? ---
**Author:** ![rahul.dhammy](https://avatars.discourse-cdn.com/v4/letter/r/e79b87/32.png) [@rahul.dhammy](https://discuss.elastic.co/u/rahul.dhammy)\ **Post date:** [July 8, 2017, 12:17am UTC](https://discuss.elastic.co/t/strange-behavior-with-elk-setup/92332/3 "2017-07-08T00:17:52Z")
Yes I am using filebeat for data shipping. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [July 8, 2017, 12:53am UTC](https://discuss.elastic.co/t/strange-behavior-with-elk-setup/92332/4 "2017-07-08T00:53:48Z")
You should use multiline on beats, it'll make things much easier. ---
**Author:** ![rahul.dhammy](https://avatars.discourse-cdn.com/v4/letter/r/e79b87/32.png) [@rahul.dhammy](https://discuss.elastic.co/u/rahul.dhammy)\ **Post date:** [July 11, 2017, 5:45pm UTC](https://discuss.elastic.co/t/strange-behavior-with-elk-setup/92332/5 "2017-07-11T17:45:22Z")
Thanks! I will check how to use that on beats and would see if it resolves my problem. Another interesting thing I noted today is, I just started filebeat on 2 servers out of 3 and there were no errors. When all the logs for 2 servers were processed I started filebeat on third server. Presently there are no errors in my logstash. My conclusion:- Looks like if lot of data at one go is send to logstash pipeline it messes up. If data is send gradually logstash works. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [July 12, 2017, 12:19pm UTC](https://discuss.elastic.co/t/strange-behavior-with-elk-setup/92332/6 "2017-07-12T12:19:52Z")
> Looks like if lot of data at one go is send to logstash pipeline it messes up. If data is send gradually logstash works. This might be true if you're using the multiline codec with the beats input. Otherwise no. ---
**Author:** ![rahul.dhammy](https://avatars.discourse-cdn.com/v4/letter/r/e79b87/32.png) [@rahul.dhammy](https://discuss.elastic.co/u/rahul.dhammy)\ **Post date:** [July 12, 2017, 6:13pm UTC](https://discuss.elastic.co/t/strange-behavior-with-elk-setup/92332/7 "2017-07-12T18:13:19Z")
I am not using multiline in filebeat so not sure why that magic is happening 🙂 For now I am not seeing any errors so I am happy. Thanks for your reply! ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [July 12, 2017, 6:59pm UTC](https://discuss.elastic.co/t/strange-behavior-with-elk-setup/92332/8 "2017-07-12T18:59:50Z")
> I am not using multiline in filebeat so not sure why that magic is happening I was referring to Logstash's multiline codec. ---
**Author:** ![rahul.dhammy](https://avatars.discourse-cdn.com/v4/letter/r/e79b87/32.png) [@rahul.dhammy](https://discuss.elastic.co/u/rahul.dhammy)\ **Post date:** [July 12, 2017, 7:26pm UTC](https://discuss.elastic.co/t/strange-behavior-with-elk-setup/92332/9 "2017-07-12T19:26:41Z")
Yes I am using Logstash's multiline input so that means it cannot process lot of data at one go. When the filebeat on each server is not started simultaneously it works, I mean there is lot of gap in starting filebeat on each server. Thanks! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 9, 2017, 7:26pm UTC](https://discuss.elastic.co/t/strange-behavior-with-elk-setup/92332/10 "2017-08-09T19:26:42Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.