# Event loss on way rsyslog-\> LS -\> ES

**URL:** <https://discuss.elastic.co/t/event-loss-on-way-rsyslog-ls-es/59099>\
**Category:** Elasticsearch\
**Created:** [August 27, 2016, 8:37pm UTC](https://discuss.elastic.co/t/event-loss-on-way-rsyslog-ls-es/59099 "2016-08-27T20:37:13Z")\
**Posts on this page:** 5\
**Page:** 2

<div class="post-metadata">

**Author:** ![bastianhoss](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bastianhoss/32/11437_2.png) [@bastianhoss](https://discuss.elastic.co/u/bastianhoss)\
**Post date:** [August 31, 2016, 7:34am UTC](https://discuss.elastic.co/t/event-loss-on-way-rsyslog-ls-es/59099/21 "2016-08-31T07:34:06Z")

</div>

Ouput of /\_cat/indices

`yellow open proxy-test 5 1 11087461 0 10.3gb 10.3gb`

Output of # cat test.log | wc -l  
`11087461`

It's exactlly the same... I've configured the matching logstash filter as follows:

input

```
   file {
    path => "test.log"
    start_position => "beginning"
    type => "test"
  }

```

filter  
`else if [type] == "test" {`  
And without `if [program] == "accesslog-elastic" {`

What's wrong with this condition: `if [program] == "accesslog-elastic"` ?

Thank you

---

<div class="post-metadata">

**Author:** ![bastianhoss](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bastianhoss/32/11437_2.png) [@bastianhoss](https://discuss.elastic.co/u/bastianhoss)\
**Post date:** [September 1, 2016, 7:45am UTC](https://discuss.elastic.co/t/event-loss-on-way-rsyslog-ls-es/59099/22 "2016-09-01T07:45:54Z")

</div>

Okay, it seems like rsyslog was overhelmed by reverse dns resolving.

I've started rsyslog with option -x

```
rsyslogd -x
```

---

<div class="post-metadata">

**Author:** ![bastianhoss](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bastianhoss/32/11437_2.png) [@bastianhoss](https://discuss.elastic.co/u/bastianhoss)\
**Post date:** [September 1, 2016, 7:49am UTC](https://discuss.elastic.co/t/event-loss-on-way-rsyslog-ls-es/59099/23 "2016-09-01T07:49:30Z")

</div>

new metric:

```
#events.rate_15m
 3,176.769
#events.rate_1m
 3,121.133 
#events.rate_5m
 3,161.205

```

I'll do some another validations to make sure that all event are recieved

---

<div class="post-metadata">

**Author:** ![bastianhoss](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bastianhoss/32/11437_2.png) [@bastianhoss](https://discuss.elastic.co/u/bastianhoss)\
**Post date:** [September 1, 2016, 8:28am UTC](https://discuss.elastic.co/t/event-loss-on-way-rsyslog-ls-es/59099/24 "2016-09-01T08:28:59Z")

</div>

Now, it seems like logstash itself is the bottleneck... Logs of proxy are nearly correct. But ASA Logs not

```
netstat -c --udp -an
Proto Recv-Q Send-Q Local Address Foreign Address State                              
udp 121936 0 :::10514 :::*           

```

Maybe to much events? Is there any opportunity to increase size of the queue or building a qeueu system ?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 10:23pm UTC](https://discuss.elastic.co/t/event-loss-on-way-rsyslog-ls-es/59099/25 "2017-07-05T22:23:23Z")

</div>



[Previous page](https://discuss.elastic.co/t/event-loss-on-way-rsyslog-ls-es/59099.md?page=1)