Logstash 5.6.8 two outputs error

Elastic Stack Logstash
1

output have two. one is output to es one is output to tcp (logstash is tcp client).
when the tcp server is down ,but the es is online .can't bulk data into es why?
and how slove it?

2

Please paste your output config. Also, please paste logs.

3

configure is

output {
  elasticsearch { 
  hosts => ["xx:9200","xx:9200","xx:9200","xx:9200","xx:9200"] 
  user => "xx" 
  password => "xx" 
  index => "xx-data-%{+YYYY.MM.dd}" 
  document_type => "docs" 
  id => "toes"
#   workers => "8"
  }
 
  tcp {
  mode => "client"
  host => "xx"
  port => 8091
  reconnect_interval => 15
#  workers => "8"
      }
}

output error is:

Failed (Connection refused - Connection refused). Sleeping for 0.02
Failed (Connection refused - Connection refused). Sleeping for 0.04
Failed (Connection refused - Connection refused). Sleeping for 0.08
Failed (Connection refused - Connection refused). Sleeping for 0.16
Failed (Connection refused - Connection refused). Sleeping for 0.32
Failed (Connection refused - Connection refused). Sleeping for 0.64
Failed (Connection refused - Connection refused). Sleeping for 1.28
Failed (Connection refused - Connection refused). Sleeping for 2.0
Failed (Connection refused - Connection refused). Sleeping for 2.0
Failed (Connection refused - Connection refused). Sleeping for 2.0
Failed (Connection refused - Connection refused). Sleeping for 2.0
Failed (Connection refused - Connection refused). Sleeping for 2.0
Failed (Connection refused - Connection refused). Sleeping for 2.0
Failed (Connection refused - Connection refused). Sleeping for 2.0
Failed (Connection refused - Connection refused). Sleeping for 2.0
Failed (Connection refused - Connection refused). Sleeping for 2.0
4

it happend this env:
es and tcp server is all ok , the output to es and tcp is ok.
when down the tcp server . can't output to es. no data find in es.

5

Per my understanding and scenarios I tested. It will send data to the Es even though your other outpu is down. In this case TCP. How did you come to conclusion that Logstash is not sending data to ES?

6

i don't find data in kibana .when the input data is also sed to logstash.

7

It will send data to the Es even though your other outpu is down.

No, that's not correct. Logstash always sends events to all outputs. If one output isn't available to process events the whole pipeline is stalled.

8

There is no doubt on your knowledge Magnus. But I observed this in Logstash 6.2.2. Let me double check it. Thanks for correcting me!

9

can change this?
if one down ,the orther output can also output ?

10

can change this?
if one down ,the orther output can also output ?

That's not configurable. You could do it with multiple Logstash instances or a single instance with multiple pipelines. One pipeline that receives and filters events and sends them to a message broker of some sort, and two pipelines (one for each output) that each subscribe to the events produced by the first instance.

11

how configure as this? in directory have two .conf file?
i use -f xxx.conf
as my env ,
can give me a example about the .conf file
thanks so.

12

how configure as this? in directory have two .conf file?
i use -f xxx.conf
as my env ,
can give me a example about the .conf file
thanks so.

13

how configure as this? in directory have two .conf file?

No. See Multiple Pipelines | Logstash Reference [8.11] | Elastic.

I don't have time to write up a complete example.

15

thanks . is only in logstash 6.x? i don't find mutiple-pipelines in logstash 5.6.8. :joy::joy::joy:
is it support logstash 5.6.8?
can use logstash 6.x output to elasticsearch 5.6.8?

16

is only in logstash 6.x?

Yes.

can use logstash 6.x output to elasticsearch 5.6.8?

Yes.

17

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.