# What is a recommended healthcheck to use for Logstash?

**URL:** <https://discuss.elastic.co/t/what-is-a-recommended-healthcheck-to-use-for-logstash/27691>\
**Category:** Logstash\
**Created:** [August 19, 2015, 4:25pm UTC](https://discuss.elastic.co/t/what-is-a-recommended-healthcheck-to-use-for-logstash/27691 "2015-08-19T16:25:15Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![kvick](https://avatars.discourse-cdn.com/v4/letter/k/c57346/32.png) [@kvick](https://discuss.elastic.co/u/kvick)\
**Post date:** [August 19, 2015, 4:25pm UTC](https://discuss.elastic.co/t/what-is-a-recommended-healthcheck-to-use-for-logstash/27691/1 "2015-08-19T16:25:15Z")

</div>

I'm in the process of upgrading from 1.4.2 to 1.5.2.

In 1.4.2, I ran Logstash with the 'web' option which I could then use in my ELB healthcheck.

```
<somepath>/logstash agent -f /etc/logstash.conf -l /<logdir>/logstash.log --verbose web -p <port>

```

This worked great, but it looks like the `web` option was removed from the agent in 1.5.0. Searching turns up some old posts about monitoring for consumption of messages (e.g. redis). We run pretty vanilla `forwarder -> logstash` and it works well for us (we're not too worried about losing a few messages).

Any simple suggestions?

Thanks,

K

---

<div class="post-metadata">

**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\
**Post date:** [August 19, 2015, 4:46pm UTC](https://discuss.elastic.co/t/what-is-a-recommended-healthcheck-to-use-for-logstash/27691/2 "2015-08-19T16:46:38Z")

</div>

Try the [heartbeat](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-heartbeat.html) plugin. I'm actually a bit surprised to hear that the `web` frontend was useful as a test.

---

<div class="post-metadata">

**Author:** ![kvick](https://avatars.discourse-cdn.com/v4/letter/k/c57346/32.png) [@kvick](https://discuss.elastic.co/u/kvick)\
**Post date:** [August 24, 2015, 9:07pm UTC](https://discuss.elastic.co/t/what-is-a-recommended-healthcheck-to-use-for-logstash/27691/3 "2015-08-24T21:07:59Z")

</div>

Thanks for the response. This seems like it would be good for metrics/alerting, but not for an active healthcheck (needed by an ELB).

I'll probably change the ELB check to look for a listening port, but that's way less useful than having the application do something and return a status.

Cheers,

K

---

<div class="post-metadata">

**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\
**Post date:** [September 1, 2015, 2:59am UTC](https://discuss.elastic.co/t/what-is-a-recommended-healthcheck-to-use-for-logstash/27691/4 "2015-09-01T02:59:20Z")

</div>

Why not have a tcp output plugin sending an "ok" from the heartbeat input plugin to your ELB? Then the ELB is in listen mode, rather than polling mode (provided that option is available—it works this way on F5s, IIRC).

```
input {
  heartbeat {
    interval => 10
    type => "heartbeat"
  }

output {
  if [type] == "heartbeat" {
    tcp {
      host => "elb.tld"
      port => 12345
      codec => plain
    }
  }
}
```

---

<div class="post-metadata">

**Author:** ![kvick](https://avatars.discourse-cdn.com/v4/letter/k/c57346/32.png) [@kvick](https://discuss.elastic.co/u/kvick)\
**Post date:** [September 1, 2015, 3:54pm UTC](https://discuss.elastic.co/t/what-is-a-recommended-healthcheck-to-use-for-logstash/27691/5 "2015-09-01T15:54:13Z")

</div>

Interesting idea. Unfortunately, Amazon ELBs don't have a listen mode. They can only poll. As they're ephemeral (and typically multi-AZ for HA) there's no simple way to push to them 'I'm OK'.

Thanks for the thought.

K

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:30am UTC](https://discuss.elastic.co/t/what-is-a-recommended-healthcheck-to-use-for-logstash/27691/6 "2017-07-06T05:30:32Z")

</div>