title: Logstash stops writting to elasticsearch after an elasticsearch restart?
body: <p>I'm fairly new to Logstash/Elasticsearch/Kibana and I'm having a strange issue with recovering logstash after elasticsearch stops and restarts.  I have an ELK install with logstash-1.4.2 and elasticsearch-1.3.4.  </p>
  
  <p>This is my scenario:</p>
  
  <p>1 - Start elastic search
  2 - Start logstash logforwarder on a remote node
  3 - Log file/ events are successfully being written to elasticsearch
  4 - Restart elasticsearch
  5 - Logstash reconnects to elastic search (I see the following messages) but <strong>events are no longer being inserted to elasticsearch</strong></p>
  
  <p>Logstash log:</p>
  
  <pre><code>log4j, [2014-11-15T16:16:20.261]  INFO: org.elasticsearch.cluster.service: [logstash-grading-n1-76848-4038] removed {[logstash-rest-n1-168118-4018][o6Gxxd1SQC2XchlsySaz8Q][rest-n1][inet[/10.165.0.31:9300]]{client=true, data=false},[Dorma][DoIcmge9QdqxiRnmBjtVdg][build][inet[/10.165.1.140:9300]],[logstash-web-n1-221006-4016][vRY0Ib7oTyOuliOYekP_nA][web-n1][inet[/10.165.0.21:9300]]{client=true, data=false},[logstash-flume-n1-99849-4018][KNknQCs0TPi6-VgiC4f-8A][flume-n1][inet[/10.165.0.41:9300]]{client=true, data=false},}, reason: zen-disco-master_failed ([Dorma][DoIcmge9QdqxiRnmBjtVdg][build][inet[/10.165.1.140:9300]])
  log4j, [2014-11-16T09:08:38.706]  INFO: org.elasticsearch.cluster.service: [logstash-grading-n1-76848-4038] detected_master [Masque][5mLN45_iTfq_YuFKV20OLg][build][inet[/10.165.1.140:9300]], added {[logstash-rest-n1-168118-4018][o6Gxxd1SQC2XchlsySaz8Q][rest-n1][inet[/10.165.0.31:9300]]{client=true, data=false},[logstash-web-n1-221006-4016][vRY0Ib7oTyOuliOYekP_nA][web-n1][inet[/10.165.0.21:9300]]{client=true, data=false},[Masque][5mLN45_iTfq_YuFKV20OLg][build][inet[/10.165.1.140:9300]],}, reason: zen-disco-receive(from master [[Masque][5mLN45_iTfq_YuFKV20OLg][build][inet[/10.165.1.140:9300]]])
  log4j, [2014-11-16T09:08:38.719]  INFO: org.elasticsearch.cluster.service: [logstash-grading-n1-76848-4038] added {[logstash-flume-n1-99849-4018][KNknQCs0TPi6-VgiC4f-8A][flume-n1][inet[/10.165.0.41:9300]]{client=true, data=false},}, reason: zen-disco-receive(from master [[Masque][5mLN45_iTfq_YuFKV20OLg][build][inet[/10.165.1.140:9300]]])
  </code></pre>
  
  <p>Elastic search log:</p>
  
  <pre><code>[2014-11-16 09:08:36,248][INFO ][gateway                  ] [Masque] recovered [8] indices into cluster_state
  ...
  [2014-11-16 09:09:39,085][INFO ][cluster.service          ] [Masque] added {[logstash-grading-n1-76848-4038][8szJ9egnQsaAvet6S10Tmw][grading-n1][inet[/10.165.0.71:9300]]{client=true, data=false},}, reason: zen-disco-receive(join from node[[logstash-grading-n1-76848-4038][8szJ9egnQsaAvet6S10Tmw][grading-n1][inet[/10.165.0.71:9300]]{client=true, data=false}])
  </code></pre>
  
  <p>6 - Restart logstash - events start working again </p>
  
  <p>So the issue is <strong>I would like to not have to restart all my logstash</strong> instances in the cluster just because of an elastic search restart.  Does anyone have any ideas whats going on?  Am I missing some configuration?</p>