# While running logstash in kubernetes we are facing below issue

**URL:** <https://discuss.elastic.co/t/while-running-logstash-in-kubernetes-we-are-facing-below-issue/326925>\
**Category:** Elastic Cloud on Kubernetes (ECK)\
**Tags:** docker\
**Created:** [March 3, 2023, 10:04am UTC](https://discuss.elastic.co/t/while-running-logstash-in-kubernetes-we-are-facing-below-issue/326925 "2023-03-03T10:04:37Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Rajesh\_R](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rajesh_r/32/113815_2.png) [@Rajesh\_R](https://discuss.elastic.co/u/Rajesh_R)\
**Post date:** [March 3, 2023, 10:04am UTC](https://discuss.elastic.co/t/while-running-logstash-in-kubernetes-we-are-facing-below-issue/326925/1 "2023-03-03T10:04:37Z")

</div>

[ERROR] 2023-03-03 10:00:52.266 [Ruby-0-Thread-5@[main]\>worker0: /usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:383] elasticsearch - Encountered a retryable error. Will Retry with exponential backoff {:code=\>400, :url=\>"https://\*\*\*\*\*\*:9200/\_bulk"}

* * *

apiVersion: v1  
kind: ConfigMap  
metadata:  
name: logstash-configmap  
namespace: default  
data:  
logstash.yml: |  
http.host: "0.0.0.0"  
path.config: /usr/share/logstash/pipeline  
logstash.conf: \>  
# all input will come from filebeat, no local logs

```
input {

file{ 
 path => "/mnt/azure/logs/*.log"
          start_position => beginning
          tags => ["rajesh"]
          sincedb_path => "NUL"
        }
      }
  filter {
  }
output {
if "test-service" in [tags] {
elasticsearch {
hosts => ["https:// ****** :9200"]
cacert => '/mnt/azure/config/certs/ca.crt'
index => "rajesh-%{+YYYY.MM.dd}"
user => " *******"
password => " **********"

}
}
}

```

* * *

apiVersion: apps/v1  
kind: Deployment  
metadata:  
name: logstash-deployment  
namespace: default  
spec:  
replicas: 1  
selector:  
matchLabels:  
app: logstash  
template:  
metadata:  
labels:  
app: logstash  
spec:  
containers:  
- name: logstash  
image: [docker.elastic.co/logstash/logstash:6.3.0](http://docker.elastic.co/logstash/logstash:6.3.0)  
ports:  
- containerPort: 5044  
volumeMounts:  
- name: azure  
mountPath: /mnt/azure/  
- name: config-volume  
mountPath: /usr/share/logstash/config  
- name: logstash-pipeline-volume  
mountPath: /usr/share/logstash/pipeline  
volumes:  
- name: azure  
persistentVolumeClaim:  
claimName: mountfileshare  
- name: config-volume  
configMap:  
name: logstash-configmap  
items:  
- key: logstash.yml  
path: logstash.yml  
- name: logstash-pipeline-volume  
configMap:  
name: logstash-configmap  
items:  
- key: logstash.conf  
path: logstash.conf

* * *

kind: Service  
apiVersion: v1  
metadata:  
name: logstash-service  
namespace: default  
spec:  
selector:  
app: logstash  
ports:  
- protocol: TCP  
port: 5044  
targetPort: 5044  
type: ClusterIP

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [March 3, 2023, 10:35am UTC](https://discuss.elastic.co/t/while-running-logstash-in-kubernetes-we-are-facing-below-issue/326925/2 "2023-03-03T10:35:09Z")

</div>

I would recommend masking password before posting them.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 2, 2023, 10:59pm UTC](https://discuss.elastic.co/t/while-running-logstash-in-kubernetes-we-are-facing-below-issue/326925/4 "2023-04-02T22:59:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.