I have 3 logstash servers, daisy chained.
First one has 2 outputs, 1 for ES and the other for 2nd Logstash.
A tcpdump shows the 2nd Logstash is receiving data.
The 2nd Logstash connects to the 3rd Logstash over TCP also, however I cannot see anything in TCPDump, unless I stop the Logstash service on the 1st Logstash, which then shows data in the TCPDUMP of the 3rd Logstash for a short time.
Please see screenshots for config files.20210826_162903|312x500