All output fail if one of tcp outputs fails

Elastic Stack Logstash
1

Guys, my logstash configuration has multiply outputs, like this:

input{
     syslog {
        port => 514
     }
}

output{
    tcp {
      host => "192.168.1.1"
      port => 1517
      codec => line { format => "%{message}" }
    }

    file {
        path => "/log/fwhw/%{+yyyyMMdd}/%{host}/%{+HH}.log"
        codec => line { format => "%{message}" }
    }
}

My question is, if #1 tcp output is failed, for example, the machine is shutdown, is it possible to let #2 output continue to work? I ask this question because I found it seems, when the first tcpout failed , the second file output also doesn't work.

2

Logstash tried to ensure no data is lost, so will stop processing if any output fails so this is expected. What do you expect to happen when an output fails?

3

In my case, because the input is udp syslog, so if logstash stoped, i will lose more...

If I can choose, i perfer to ignore one of the output failure. for example, if tcp output is failed, then the syslog log will still write into log files.

4

If you can only need to handle temporary failures configuring s persistent queue can allow Logstash to buffer data. For longer outages it is more difficult and you may need to setup multiple pipelines with persistent queues or add some type of external buffering.

5

Got it, tks Christian

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.