# Handle timeouts with the syslog output

**URL:** <https://discuss.elastic.co/t/handle-timeouts-with-the-syslog-output/194194>\
**Category:** Logstash\
**Created:** [August 7, 2019, 9:20am UTC](https://discuss.elastic.co/t/handle-timeouts-with-the-syslog-output/194194 "2019-08-07T09:20:33Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![victor.nilsson](https://avatars.discourse-cdn.com/v4/letter/v/eb8c5e/32.png) [@victor.nilsson](https://discuss.elastic.co/u/victor.nilsson)\
**Post date:** [August 7, 2019, 9:20am UTC](https://discuss.elastic.co/t/handle-timeouts-with-the-syslog-output/194194/1 "2019-08-07T09:20:34Z")

</div>

Hi,

We have a use case of sending logs to two ELK stacks and letting the first ELK stack forward some events to a second ELK stack.

So messages arrive at ELK-Stack1. Logstash receives the messages and outputs to its Elasticsearch instance and at the same time sends the same message to ELK-Stack2's Logstash over port 514 TCP.

We noticed however, that if the second ELK stacks's logstash instance for some reason is unable to reach, the first ELK stack's logstash will queue the events until the persistent queue is full or the second logstash instanse responds again.

Is there a nice way to handle this? For example, attach a tag to the message when we are unable to forward the messages from ELK stack 1 to ELK stack 2? Then forward the events to the first ELK stacks's Elasticsearch instance and then manually move the messages with the tag to the second ELK stack?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 7, 2019, 11:33am UTC](https://discuss.elastic.co/t/handle-timeouts-with-the-syslog-output/194194/2 "2019-08-07T11:33:46Z")

</div>

> [@victor.nilsson](#):
>
> Is there a nice way to handle this?

No. This is working as designed. It sounds like you want something like a [DLQ](https://www.elastic.co/guide/en/logstash/current/dead-letter-queues.html), but that has only been implemented for the elasticsearch output.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 4, 2019, 11:33am UTC](https://discuss.elastic.co/t/handle-timeouts-with-the-syslog-output/194194/3 "2019-09-04T11:33:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.