Daisy chained logstash not recieving using TCP

Hi there

I have 3 logstash servers, daisy chained.

First one has 2 outputs, 1 for ES and the other for 2nd Logstash.

A tcpdump shows the 2nd Logstash is receiving data.

The 2nd Logstash connects to the 3rd Logstash over TCP also, however I cannot see anything in TCPDump, unless I stop the Logstash service on the 1st Logstash, which then shows data in the TCPDUMP of the 3rd Logstash for a short time.

Please see screenshots for config files.20210826_162903|312x500



The default codec for a tcp input is line, which requires newline separated data. The default codec for a tcp output is json, which does not include newlines. You need to adjust your codecs.

Thanks @Badger. On Logstash 1,2,3 for the TCP outputs and inputs I've used the JSON codec for each, however Logstash 3 still does not have any incoming data according to TCPDump.

Awesome. I used json_lines for each input and output and BOOM!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.