Daisy chained logstash not recieving using TCP

Elastic Stack Logstash
1

Hi there

I have 3 logstash servers, daisy chained.

First one has 2 outputs, 1 for ES and the other for 2nd Logstash.

A tcpdump shows the 2nd Logstash is receiving data.

The 2nd Logstash connects to the 3rd Logstash over TCP also, however I cannot see anything in TCPDump, unless I stop the Logstash service on the 1st Logstash, which then shows data in the TCPDUMP of the 3rd Logstash for a short time.

Please see screenshots for config files.20210826_162903|312x500

20210826_162447
20210826_1624471265×1176 341 KB

Screenshot_20210826-162127_Gallery
Screenshot_20210826-162127_Gallery852×540 129 KB

20210826_162004
20210826_1620041468×996 342 KB

2

The default codec for a tcp input is line, which requires newline separated data. The default codec for a tcp output is json, which does not include newlines. You need to adjust your codecs.

3

Thanks @Badger. On Logstash 1,2,3 for the TCP outputs and inputs I've used the JSON codec for each, however Logstash 3 still does not have any incoming data according to TCPDump.

4

Awesome. I used json_lines for each input and output and BOOM!