Unless you have configured Logstash to drop certain messages I find it hard to believe that some messages aren't being processed. What does your Logstash configuration look like? And have you tried creating a minimal example that reproduces the problem? Like a tiny file with just a few log entries and a stdout { codec => rubydebug } Logstash output that just dumps all events?