First one has 2 outputs, 1 for ES and the other for 2nd Logstash.
A tcpdump shows the 2nd Logstash is receiving data.
The 2nd Logstash connects to the 3rd Logstash over TCP also, however I cannot see anything in TCPDump, unless I stop the Logstash service on the 1st Logstash, which then shows data in the TCPDUMP of the 3rd Logstash for a short time.
The default codec for a tcp input is line, which requires newline separated data. The default codec for a tcp output is json, which does not include newlines. You need to adjust your codecs.
Thanks @Badger. On Logstash 1,2,3 for the TCP outputs and inputs I've used the JSON codec for each, however Logstash 3 still does not have any incoming data according to TCPDump.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.