# Troubles with elastic + logstash + rabbit

**URL:** <https://discuss.elastic.co/t/troubles-with-elastic-logstash-rabbit/44524>\
**Category:** Logstash\
**Created:** [March 16, 2016, 8:09am UTC](https://discuss.elastic.co/t/troubles-with-elastic-logstash-rabbit/44524 "2016-03-16T08:09:05Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Igor\_Samusenko](https://avatars.discourse-cdn.com/v4/letter/i/13edae/32.png) [@Igor\_Samusenko](https://discuss.elastic.co/u/Igor_Samusenko)\
**Post date:** [March 16, 2016, 8:09am UTC](https://discuss.elastic.co/t/troubles-with-elastic-logstash-rabbit/44524/1 "2016-03-16T08:09:05Z")

</div>

Hi everybody,  
We are using elastic stack for storing logs data.  
We use rabbitmq as an input for logstash.

For some reasons our elasticsearch cluster has been down for several times. And logstash was unable to deliver massages, but them also gone from rabbitmq.  
What should I do in such cases to prevent message disappearing?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 16, 2016, 8:18am UTC](https://discuss.elastic.co/t/troubles-with-elastic-logstash-rabbit/44524/2 "2016-03-16T08:18:54Z")

</div>

This shouldn't be a problem. Logstash should halt the pipeline when ES is unavailable. Do you have any logs that can give clues into what happened?

---

<div class="post-metadata">

**Author:** ![Igor\_Samusenko](https://avatars.discourse-cdn.com/v4/letter/i/13edae/32.png) [@Igor\_Samusenko](https://discuss.elastic.co/u/Igor_Samusenko)\
**Post date:** [March 16, 2016, 8:44am UTC](https://discuss.elastic.co/t/troubles-with-elastic-logstash-rabbit/44524/3 "2016-03-16T08:44:46Z")

</div>

Thanks for your response.  
It seems that logstash does not do that. May be I need to specify some option in logstash.conf ?

The issue is probably dots-contained filed keys.

> MapperParsingException[Field name [f5269b709d9646188e77c14467419d5bYii.User.flash.success] cannot contain '.']

Can it be the cause of elasticsearch failing ?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 16, 2016, 8:45am UTC](https://discuss.elastic.co/t/troubles-with-elastic-logstash-rabbit/44524/4 "2016-03-16T08:45:49Z")

</div>

Yes, that would explain things.

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [March 16, 2016, 8:50am UTC](https://discuss.elastic.co/t/troubles-with-elastic-logstash-rabbit/44524/5 "2016-03-16T08:50:50Z")

</div>

In addition to containing dots, the first part looks like a potentially dynamic component. If that is the case, be aware that this can cause [mapping explosion](https://www.elastic.co/blog/found-crash-elasticsearch#mapping-explosion).

---

<div class="post-metadata">

**Author:** ![Igor\_Samusenko](https://avatars.discourse-cdn.com/v4/letter/i/13edae/32.png) [@Igor\_Samusenko](https://discuss.elastic.co/u/Igor_Samusenko)\
**Post date:** [March 16, 2016, 9:07am UTC](https://discuss.elastic.co/t/troubles-with-elastic-logstash-rabbit/44524/6 "2016-03-16T09:07:48Z")

</div>

Thanks! In that case I won't have to worry about dot contained keys cuz they would be the values =)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:06am UTC](https://discuss.elastic.co/t/troubles-with-elastic-logstash-rabbit/44524/7 "2017-07-06T05:06:47Z")

</div>