# When logstash is down , app container fails to start

**URL:** <https://discuss.elastic.co/t/when-logstash-is-down-app-container-fails-to-start/199195>\
**Category:** Logstash\
**Created:** [September 12, 2019, 8:15am UTC](https://discuss.elastic.co/t/when-logstash-is-down-app-container-fails-to-start/199195 "2019-09-12T08:15:06Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![markrity](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/markrity/32/100712_2.png) [@markrity](https://discuss.elastic.co/u/markrity)\
**Post date:** [September 12, 2019, 8:15am UTC](https://discuss.elastic.co/t/when-logstash-is-down-app-container-fails-to-start/199195/1 "2019-09-12T08:15:06Z")

</div>

Hi I run couple of micro-services that write logs to Logstash on ECS,  
Unfortunately if Logstash happens to be unavailable, any app-Task container that writes to logstash fails to startup.  
How to handle this kind of failures ?

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [September 14, 2019, 10:33am UTC](https://discuss.elastic.co/t/when-logstash-is-down-app-container-fails-to-start/199195/2 "2019-09-14T10:33:08Z")

</div>

How are you writing yo Logstash? If you are using sockets, this is one of the reasons logging to file from an application is recommended as it reduces dependencies and prevents the ingest pipeline from affecting the application.

---

<div class="post-metadata">

**Author:** ![endersonmaia](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/endersonmaia/32/17308_2.png) [@endersonmaia](https://discuss.elastic.co/u/endersonmaia)\
**Post date:** [September 14, 2019, 9:37pm UTC](https://discuss.elastic.co/t/when-logstash-is-down-app-container-fails-to-start/199195/3 "2019-09-14T21:37:26Z")

</div>

so what do you recommend ?

logging to local ephemeral container filesystem and use a second process like filebeat to collect the logs and ship to logstash would be a solution ?

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [September 15, 2019, 6:14am UTC](https://discuss.elastic.co/t/when-logstash-is-down-app-container-fails-to-start/199195/4 "2019-09-15T06:14:58Z")

</div>

Yes, that is a very common solution.

---

<div class="post-metadata">

**Author:** ![markrity](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/markrity/32/100712_2.png) [@markrity](https://discuss.elastic.co/u/markrity)\
**Post date:** [September 19, 2019, 9:03am UTC](https://discuss.elastic.co/t/when-logstash-is-down-app-container-fails-to-start/199195/5 "2019-09-19T09:03:24Z")

</div>

@Christian_Dahlqvist  
That solution sounds reasonable , but what with the case I don't mind loosing the logs , I just want my containers be able to start up . Do you know of any solution to handle that case?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 17, 2019, 9:03am UTC](https://discuss.elastic.co/t/when-logstash-is-down-app-container-fails-to-start/199195/6 "2019-10-17T09:03:26Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.