# Decoding with logstash-avro Flume Avro Sink events

**URL:** https://discuss.elastic.co/t/decoding-with-logstash-avro-flume-avro-sink-events/65024
**Category:** Logstash
**Created:** [November 4, 2016, 4:02pm UTC](https://discuss.elastic.co/t/decoding-with-logstash-avro-flume-avro-sink-events/65024 "2016-11-04T16:02:01Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![dcam](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dcam/32/51518_2.png) [@dcam](https://discuss.elastic.co/u/dcam)
#### Post date: [November 4, 2016, 4:02pm UTC](https://discuss.elastic.co/t/decoding-with-logstash-avro-flume-avro-sink-events/65024/1 "2016-11-04T16:02:01Z")

</div>

I am getting apache Flume events from Avro Sink into Logstash but messages are not correctly decoded from logstash-codec-avro.

Some ideas how to solve it would be very helpful

My logstash conf looks like:

```
input {
  tcp {
  port => 42001
  codec => avro { schema_uri => "/tmp/schema.avsc" }
  }
    }

    output {
      stdout {
      codec => rubydebug
      #codec => avro { schema_uri => "/tmp/schema.avsc"}
     }
    }

```

schema.avsc:

```
{
     "type": "record",
     "namespace": "com.example",
     "name": "FullName",
     "fields": [
       {"name":"first","type":"string"}
     ]
}

```

_Outputs_

```
An error occurred. Closing connection {:exception=>ArgumentError: negative length -2 given>,

{
         "first" => R\u0019\xD0\u0005\x80\xAA\xC4\u0012\v\nR\xF3R\x9C\u0012K\x923\x80z\x84\x99\u0018䪕\xD22\x8B\x8AK\x94",
      "@version" => "1",
    "@timestamp" => "2016-11-04T15:57:56.083Z",
          "host" => "127.0.0.1",
          "port" => 42574
}
```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:30am UTC](https://discuss.elastic.co/t/decoding-with-logstash-avro-flume-avro-sink-events/65024/2 "2017-07-06T04:30:53Z")

</div>