# What happens when using Logstash and Filebeat in production and any of them fails?

**URL:** <https://discuss.elastic.co/t/what-happens-when-using-logstash-and-filebeat-in-production-and-any-of-them-fails/73027>\
**Category:** Logstash\
**Created:** [January 27, 2017, 2:33pm UTC](https://discuss.elastic.co/t/what-happens-when-using-logstash-and-filebeat-in-production-and-any-of-them-fails/73027 "2017-01-27T14:33:54Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Svetoslav\_Anastasov](https://avatars.discourse-cdn.com/v4/letter/s/d78d45/32.png) [@Svetoslav\_Anastasov](https://discuss.elastic.co/u/Svetoslav_Anastasov)\
**Post date:** [January 27, 2017, 2:33pm UTC](https://discuss.elastic.co/t/what-happens-when-using-logstash-and-filebeat-in-production-and-any-of-them-fails/73027/1 "2017-01-27T14:33:55Z")

</div>

Hello, I am currently testing the ELK. My system contains of a few machines producing logs with Filebeat on them. One machine with centralized Logstash and from there pushing logs into AWS ES. When I push this into production and sometimes for some reason my Logstash or any of my Filebeat machines crash, or just the service crashes. What happens after that? How do I get notified that something has crashed? When resumed from where does Filebeat pick up from, can it know where it left of, as there will be a lot more logs in the folder by then? What happens when Logstash crashes?

---

<div class="post-metadata">

**Author:** ![JKhondhu](https://avatars.discourse-cdn.com/v4/letter/j/ed655f/32.png) [@JKhondhu](https://discuss.elastic.co/u/JKhondhu)\
**Post date:** [January 27, 2017, 11:03pm UTC](https://discuss.elastic.co/t/what-happens-when-using-logstash-and-filebeat-in-production-and-any-of-them-fails/73027/2 "2017-01-27T23:03:28Z")

</div>

Are you using watcher for notifications?  
Have you thought about implementing an ingest pipeline with Kafka. Something interesting to share: [https://www.elastic.co/blog/integrating-elastic-stack-with-arcsight-siem-part-3](https://www.elastic.co/blog/integrating-elastic-stack-with-arcsight-siem-part-3)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 24, 2017, 11:03pm UTC](https://discuss.elastic.co/t/what-happens-when-using-logstash-and-filebeat-in-production-and-any-of-them-fails/73027/3 "2017-02-24T23:03:34Z")

</div>

Closed on February 24, 2017, 11:03pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.