# Could Filebeat use UDP to send data to logstash? **URL:** \ **Category:** Beats\ **Created:** [December 29, 2017, 5:05am UTC](https://discuss.elastic.co/t/could-filebeat-use-udp-to-send-data-to-logstash/113527 "2017-12-29T05:05:37Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![vermouth0064](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vermouth0064/32/23484_2.png) [@vermouth0064](https://discuss.elastic.co/u/vermouth0064)\ **Post date:** [December 29, 2017, 5:05am UTC](https://discuss.elastic.co/t/could-filebeat-use-udp-to-send-data-to-logstash/113527/1 "2017-12-29T05:05:37Z")
My boss argues that the TCP protocol in filebeat increases too many connections that will fill the connection pool and block other processes, so he advised us to use UDP. My question is whether he is correct and whether filebeat can use the UDP protocol. How can I persuade my boss that using TCP is ok? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [December 29, 2017, 5:06am UTC](https://discuss.elastic.co/t/could-filebeat-use-udp-to-send-data-to-logstash/113527/2 "2017-12-29T05:06:01Z")
Are these logs not important to anyone? ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [December 29, 2017, 5:16am UTC](https://discuss.elastic.co/t/could-filebeat-use-udp-to-send-data-to-logstash/113527/3 "2017-12-29T05:16:16Z")
UDP is light-weight and fast, but does not offer any kind of delivery guarantee or retry mechanism. If you are fine losing some, or potentials all, of the data it is a very efficient protocol. This lack of delivery guarantee is also why it is not supported by Filebeat, as data loss is generally not acceptable when it comes to logs. ---
**Author:** ![vermouth0064](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vermouth0064/32/23484_2.png) [@vermouth0064](https://discuss.elastic.co/u/vermouth0064)\ **Post date:** [December 29, 2017, 8:46am UTC](https://discuss.elastic.co/t/could-filebeat-use-udp-to-send-data-to-logstash/113527/4 "2017-12-29T08:46:39Z")
Emmm, then will the TCP protocol cause some problem such as blocking other processes? Does the filebeat's TCP way have some methods to limit the number of connecctions? As some more important systems are runing in the same server, we are concerned that the potential faults of the filebeat's TCP way may make the important systems unavailable. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [December 29, 2017, 9:09am UTC](https://discuss.elastic.co/t/could-filebeat-use-udp-to-send-data-to-logstash/113527/5 "2017-12-29T09:09:36Z")
Is this concern based on tests you have performed or speculation? ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [January 4, 2018, 1:09pm UTC](https://discuss.elastic.co/t/could-filebeat-use-udp-to-send-data-to-logstash/113527/6 "2018-01-04T13:09:04Z")
There has been a recent bug fix to the the logstash plugin to fix connections being left in CLOSE\_WAIT state on the logstash side: [https://github.com/logstash-plugins/logstash-input-beats/blob/master/CHANGELOG.md#504](https://github.com/logstash-plugins/logstash-input-beats/blob/master/CHANGELOG.md#504) > TCP protocol cause some problem such as blocking other processes Why you think filebeat using TCP will block other processes? > TCP way have some methods to limit the number of connections filebeat uses one TCP socket per host/worker. On I/O errors, filebeat closes the socket and creates a new one. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 19, 2018, 5:05am UTC](https://discuss.elastic.co/t/could-filebeat-use-udp-to-send-data-to-logstash/113527/7 "2018-01-19T05:05:45Z")
This topic was automatically closed after 21 days. New replies are no longer allowed.