# Data Dropped by Logstash
**URL:** https://discuss.elastic.co/t/data-dropped-by-logstash/221465
**Category:** Logstash
**Created:** [February 28, 2020, 5:02pm UTC](https://discuss.elastic.co/t/data-dropped-by-logstash/221465 "2020-02-28T17:02:33Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@kunal.1709](https://discuss.elastic.co/u/kunal.1709)
#### Post date: [February 28, 2020, 5:02pm UTC](https://discuss.elastic.co/t/data-dropped-by-logstash/221465/1 "2020-02-28T17:02:34Z")
Hello Everyone,
While debugging the issue with TCP input with logstash, I have introduced Rsyslog as an intermediate between SIEM and Logstash as a temporary workaround.
Please refer to below link -
> [@Unable to split message received on TCP port into individual records](https://discuss.elastic.co/t/unable-to-split-message-received-on-tcp-port-into-individual-records/218836/2):
>
> A tcp input creates one event for each line of text. If your messages do not contain a newline it will not flush them until it is stopped.
SIEM -\> Rsyslog (TCP) -\> Logstash (TCP)
Even though this approach is working, there is significant amount of data being dropped between Rsyslog and Logstash.
For instance, If SIEM is sending 1,000,000 records, Rsyslog is capturing 997,000 on average but Logstash is capturing only 500,000 records
I have tried persistent queues as well
Please refer to below logstash.yml
path.data: /var/lib/logstash
queue.type: persisted
path.queue: /home/logstash
queue.max\_bytes: 128mb
dead\_letter\_queue.enable: true
path.dead\_letter\_queue: /home/logstash/dead\_queue
path.logs: /var/log/logstash
config.reload.automatic: true
config.reload.interval: 1s
Kindly let me know if you have any suggestions to try out
Thank You !!!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 27, 2020, 5:02pm UTC](https://discuss.elastic.co/t/data-dropped-by-logstash/221465/2 "2020-03-27T17:02:43Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.