# When the output target stops for a period of time and then resumes, filebeat is in a blocking state

**URL:** <https://discuss.elastic.co/t/when-the-output-target-stops-for-a-period-of-time-and-then-resumes-filebeat-is-in-a-blocking-state/303086>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [April 24, 2022, 7:51am UTC](https://discuss.elastic.co/t/when-the-output-target-stops-for-a-period-of-time-and-then-resumes-filebeat-is-in-a-blocking-state/303086 "2022-04-24T07:51:33Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![lhb6540](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lhb6540/32/104727_2.png) [@lhb6540](https://discuss.elastic.co/u/lhb6540)\
**Post date:** [April 24, 2022, 7:51am UTC](https://discuss.elastic.co/t/when-the-output-target-stops-for-a-period-of-time-and-then-resumes-filebeat-is-in-a-blocking-state/303086/1 "2022-04-24T07:51:34Z")

</div>

version: 7.16  
os: centos 7.6  
install: rpm  
Steps to Reproduce:

1. When the input of filebeat is an http endpoint, and the output is configured as a logstash.
2. filebeat has a large qps, such as 60/s, you can use a script to concurrently request to achieve
3. Stop logstash, or make filebeat unable to access logstash by other means.
4. Wait for a period of time, more than 10s or 1-2 minutes, then restore logstash to normal work  
At this point, you can observe that filebeat cannot receive http requests normally, and you can see that the Error in the log changes from  
`connect: connection refused` to  
`socket: too many open files`,  
and execute  
`netstat -tnl`  
to observe Rec- Q stacking

Maybe the log and Rec-Q are not necessarily reproducible. For example, I am on another machine and the Error log observed is "i/o timeout", but it can be reproduced that filebeat can no longer work normally.  
My only recovery at the moment is to restart filebeat

Below is an example of my config file：

```auto
logging.metrics.enabled: false
logging.selectors: [processors]
logging.files.name: filebeat.log
logging.files.keepfiles: 15
logging.files.rotateeverybytes: 1073741824

filebeat.inputs:
- type: http_endpoint
  enabled: true
  listen_address: 0.0.0.0
  listen_port: 8443
  include_headers: ["User-Agent","x-forwarded-for","x-remote-IP","x-originating-IP","x-remote-ip","x-remote-addr","x-client-ip","x-client-IP","X-Real-ip","remote_addr","client-ip"]

output.logstash:
hosts: ["10.168.0.30:44050"]

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 22, 2022, 9:52am UTC](https://discuss.elastic.co/t/when-the-output-target-stops-for-a-period-of-time-and-then-resumes-filebeat-is-in-a-blocking-state/303086/2 "2022-05-22T09:52:34Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.