# Teardown process

**URL:** <https://discuss.elastic.co/t/teardown-process/23949>\
**Category:** Logstash\
**Created:** [June 18, 2015, 10:56pm UTC](https://discuss.elastic.co/t/teardown-process/23949 "2015-06-18T22:56:28Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![kelvinfann](https://avatars.discourse-cdn.com/v4/letter/k/13edae/32.png) [@kelvinfann](https://discuss.elastic.co/u/kelvinfann)\
**Post date:** [June 18, 2015, 10:56pm UTC](https://discuss.elastic.co/t/teardown-process/23949/1 "2015-06-18T22:56:28Z")

</div>

Hi I was wondering if it was possible to get more information about how logstash processes the teardown. I'd imagine it first tearsdown the input, then filters, then output. If there are messages in the filter queue, do these get finished processing through the pipeline (out to output) before the shutdown? Or are those just simply lost?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [June 19, 2015, 12:36am UTC](https://discuss.elastic.co/t/teardown-process/23949/2 "2015-06-19T00:36:23Z")

</div>

It tries to flush anything that lives in it's queue, not sure on the rest though.

---

<div class="post-metadata">

**Author:** ![kelvinfann](https://avatars.discourse-cdn.com/v4/letter/k/13edae/32.png) [@kelvinfann](https://discuss.elastic.co/u/kelvinfann)\
**Post date:** [June 19, 2015, 6:37pm UTC](https://discuss.elastic.co/t/teardown-process/23949/3 "2015-06-19T18:37:33Z")

</div>

EDIT: Actually, another question. Is it possible to flush a last message out from my filter into the output?  
Or, is it possible for to set logstash such that on a shutdown call, it will just stop reading the inputs, and let all the messages in the queue to run through logstash (filter-\>output)? Or does that do it by default?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 30, 2015, 8:47pm UTC](https://discuss.elastic.co/t/teardown-process/23949/4 "2015-06-30T20:47:27Z")

</div>

Logstash 1.5 by default stops all inputs and tries to flush all messages currently in the internal queue (20 messages, tops) before shutting down in response to SIGTERM or SIGINT. See the `shutdown` and `run` methods in [pipeline.rb](https://github.com/elastic/logstash/blob/master/lib/logstash/pipeline.rb).

Logstash 1.4.2 only tried a graceful shutdown in response to SIGINT; SIGTERM means an abrupt shutdown.

---

<div class="post-metadata">

**Author:** ![fh8510](https://avatars.discourse-cdn.com/v4/letter/f/b487fb/32.png) [@fh8510](https://discuss.elastic.co/u/fh8510)\
**Post date:** [July 2, 2015, 6:14pm UTC](https://discuss.elastic.co/t/teardown-process/23949/5 "2015-07-02T18:14:21Z")

</div>

@kelvinfann Below is a link to github issue describing the details of the shutdown process as it relates to input plugins. This very good explanation of the shutdown sequence shed light on why I was seeing my input plugin 'teardown' method being called twice.

> <https://github.com/elastic/logstash/issues/3210>

---

<div class="post-metadata">

**Author:** ![kelvinfann](https://avatars.discourse-cdn.com/v4/letter/k/13edae/32.png) [@kelvinfann](https://discuss.elastic.co/u/kelvinfann)\
**Post date:** [July 2, 2015, 7:01pm UTC](https://discuss.elastic.co/t/teardown-process/23949/6 "2015-07-02T19:01:12Z")

</div>

Thanks for the help! @fh8510 I actually ran into the same issue of teardown being called twice as well and was rather confused until I found that git issue as well. Also thanks @magnusbaeck for consistently helping me out.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:35am UTC](https://discuss.elastic.co/t/teardown-process/23949/7 "2017-07-06T05:35:43Z")

</div>

Closed on July 6, 2017, 5:35am UTC


