# Daisy chained logstash not recieving using TCP

**URL:** <https://discuss.elastic.co/t/daisy-chained-logstash-not-recieving-using-tcp/282599>\
**Category:** Logstash\
**Created:** [August 26, 2021, 3:32pm UTC](https://discuss.elastic.co/t/daisy-chained-logstash-not-recieving-using-tcp/282599 "2021-08-26T15:32:16Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Spencer\_Hazell](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spencer_hazell/32/93779_2.png) [@Spencer\_Hazell](https://discuss.elastic.co/u/Spencer_Hazell)\
**Post date:** [August 26, 2021, 3:32pm UTC](https://discuss.elastic.co/t/daisy-chained-logstash-not-recieving-using-tcp/282599/1 "2021-08-26T15:32:16Z")

</div>

Hi there

I have 3 logstash servers, daisy chained.

First one has 2 outputs, 1 for ES and the other for 2nd Logstash.

A tcpdump shows the 2nd Logstash is receiving data.

The 2nd Logstash connects to the 3rd Logstash over TCP also, however I cannot see anything in TCPDump, unless I stop the Logstash service on the 1st Logstash, which then shows data in the TCPDUMP of the 3rd Logstash for a short time.

Please see screenshots for config files.[20210826\_162903|312x500](https://discuss.elastic.co/uploads/short-url/6hOq7Hsw12zYKLZS8RBnDUA7zxX.jpeg)

 ![20210826_162447](https://us1.discourse-cdn.com/elastic/original/3X/2/f/2f9fa4b591dc56da80a26a7e8870841b1c6475d7.jpeg)  
 ![Screenshot_20210826-162127_Gallery](https://us1.discourse-cdn.com/elastic/original/3X/0/f/0f5d4180edb4f5e1eede2c48cae2fba82096dbc9.jpeg)  
 ![20210826_162004](https://us1.discourse-cdn.com/elastic/original/3X/0/4/04d889d6877b4acdb871505c411dd07da27d87c1.jpeg)

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 26, 2021, 3:43pm UTC](https://discuss.elastic.co/t/daisy-chained-logstash-not-recieving-using-tcp/282599/2 "2021-08-26T15:43:22Z")

</div>

The default codec for a tcp input is line, which requires newline separated data. The default codec for a tcp output is json, which does not include newlines. You need to adjust your codecs.

---

<div class="post-metadata">

**Author:** ![Spencer\_Hazell](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spencer_hazell/32/93779_2.png) [@Spencer\_Hazell](https://discuss.elastic.co/u/Spencer_Hazell)\
**Post date:** [August 27, 2021, 7:17am UTC](https://discuss.elastic.co/t/daisy-chained-logstash-not-recieving-using-tcp/282599/3 "2021-08-27T07:17:22Z")

</div>

Thanks @Badger. On Logstash 1,2,3 for the TCP outputs and inputs I've used the JSON codec for each, however Logstash 3 still does not have any incoming data according to TCPDump.

---

<div class="post-metadata">

**Author:** ![Spencer\_Hazell](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spencer_hazell/32/93779_2.png) [@Spencer\_Hazell](https://discuss.elastic.co/u/Spencer_Hazell)\
**Post date:** [August 27, 2021, 7:29am UTC](https://discuss.elastic.co/t/daisy-chained-logstash-not-recieving-using-tcp/282599/4 "2021-08-27T07:29:53Z")

</div>

Awesome. I used json\_lines for each input and output and BOOM!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 24, 2021, 7:30am UTC](https://discuss.elastic.co/t/daisy-chained-logstash-not-recieving-using-tcp/282599/5 "2021-09-24T07:30:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.