# All output fail if one of tcp outputs fails

**URL:** <https://discuss.elastic.co/t/all-output-fail-if-one-of-tcp-outputs-fails/193703>\
**Category:** Logstash\
**Created:** [August 5, 2019, 2:15am UTC](https://discuss.elastic.co/t/all-output-fail-if-one-of-tcp-outputs-fails/193703 "2019-08-05T02:15:29Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![dickens88](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dickens88/32/52425_2.png) [@dickens88](https://discuss.elastic.co/u/dickens88)\
**Post date:** [August 5, 2019, 2:15am UTC](https://discuss.elastic.co/t/all-output-fail-if-one-of-tcp-outputs-fails/193703/1 "2019-08-05T02:15:29Z")

</div>

Guys, my logstash configuration has multiply outputs, like this:

```auto
input{
     syslog {
        port => 514
     }
}

output{
    tcp {
      host => "192.168.1.1"
      port => 1517
      codec => line { format => "%{message}" }
    }

    file {
        path => "/log/fwhw/%{+yyyyMMdd}/%{host}/%{+HH}.log"
        codec => line { format => "%{message}" }
    }
}

```

My question is, if #1 tcp output is failed, for example, the machine is shutdown, is it possible to let #2 output continue to work? I ask this question because I found it seems, when the first tcpout failed , the second file output also doesn't work.

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [August 5, 2019, 2:29am UTC](https://discuss.elastic.co/t/all-output-fail-if-one-of-tcp-outputs-fails/193703/2 "2019-08-05T02:29:56Z")

</div>

Logstash tried to ensure no data is lost, so will stop processing if any output fails so this is expected. What do you expect to happen when an output fails?

---

<div class="post-metadata">

**Author:** ![dickens88](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dickens88/32/52425_2.png) [@dickens88](https://discuss.elastic.co/u/dickens88)\
**Post date:** [August 5, 2019, 2:45am UTC](https://discuss.elastic.co/t/all-output-fail-if-one-of-tcp-outputs-fails/193703/3 "2019-08-05T02:45:20Z")

</div>

In my case, because the input is udp syslog, so if logstash stoped, i will lose more...

If I can choose, i perfer to ignore one of the output failure. for example, if tcp output is failed, then the syslog log will still write into log files.

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [August 5, 2019, 3:02am UTC](https://discuss.elastic.co/t/all-output-fail-if-one-of-tcp-outputs-fails/193703/4 "2019-08-05T03:02:21Z")

</div>

If you can only need to handle temporary failures configuring s persistent queue can allow Logstash to buffer data. For longer outages it is more difficult and you may need to setup multiple pipelines with persistent queues or add some type of external buffering.

---

<div class="post-metadata">

**Author:** ![dickens88](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dickens88/32/52425_2.png) [@dickens88](https://discuss.elastic.co/u/dickens88)\
**Post date:** [August 5, 2019, 3:05am UTC](https://discuss.elastic.co/t/all-output-fail-if-one-of-tcp-outputs-fails/193703/5 "2019-08-05T03:05:33Z")

</div>

> [@Christian\_Dahlqvist](#):
>
> persistent queue

Got it, tks Christian

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 2, 2019, 3:05am UTC](https://discuss.elastic.co/t/all-output-fail-if-one-of-tcp-outputs-fails/193703/6 "2019-09-02T03:05:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.