# Logstash forwarder is sending a message to multiple servers

**URL:** <https://discuss.elastic.co/t/logstash-forwarder-is-sending-a-message-to-multiple-servers/35574>\
**Category:** Logstash\
**Created:** [November 25, 2015, 3:13pm UTC](https://discuss.elastic.co/t/logstash-forwarder-is-sending-a-message-to-multiple-servers/35574 "2015-11-25T15:13:42Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![tsvivek](https://avatars.discourse-cdn.com/v4/letter/t/f07891/32.png) [@tsvivek](https://discuss.elastic.co/u/tsvivek)\
**Post date:** [November 25, 2015, 3:13pm UTC](https://discuss.elastic.co/t/logstash-forwarder-is-sending-a-message-to-multiple-servers/35574/1 "2015-11-25T15:13:42Z")

</div>

We have multiple ELK environments (dev, test etc) and have observed recently that the forwarder is sending messages to multiple environments.

In all environments, the forwarder config looks like this:

{

# The network section covers network configuration

"network": {

```
"servers": ["host123.domain.com:5043"],

#"ssl key": "./logstash-forwarder.key",

# The path to your trusted ssl CA file. This is used
# to authenticate your downstream server.
"ssl ca": "/etc/pki/tls/certs/logstash-forwarder.crt",

"timeout": 15

```

}  
}

An /etc/hosts entry maps the host123 to the appropriate IP in each environment. Is there a way to enable verbosity in the forwarder logs to see why it is sending to multiple servers ?

---

<div class="post-metadata">

**Author:** ![Ryan\_Young](https://avatars.discourse-cdn.com/v4/letter/r/ee59a6/32.png) [@Ryan\_Young](https://discuss.elastic.co/u/Ryan_Young)\
**Post date:** [November 25, 2015, 6:29pm UTC](https://discuss.elastic.co/t/logstash-forwarder-is-sending-a-message-to-multiple-servers/35574/2 "2015-11-25T18:29:45Z")

</div>

@tsvivek

You can do a couple things if you run logstash forwarder manually:

sudo /opt/logstash-forwarder/bin/logstash-forwarder -config /etc/logstash-forwarder.conf

It will output the number of events and whom and what it connected to, unless you have changed the default you can also find a logs in /var/log/logstash-forwarder/

The thing about linux is the only way it knows about anything upstream is it must be explicitly stated there is not much under the hood if you only have one host listed for your connection then I would look upstream at the Logstash host to see where it is outputting received logs.

I'm assuming that host123 is an example in reality each host has a different hostname in your "hosts" file?

Can you santize your forwarder config and post the full thing?

---

<div class="post-metadata">

**Author:** ![tsvivek](https://avatars.discourse-cdn.com/v4/letter/t/f07891/32.png) [@tsvivek](https://discuss.elastic.co/u/tsvivek)\
**Post date:** [November 26, 2015, 5:59am UTC](https://discuss.elastic.co/t/logstash-forwarder-is-sending-a-message-to-multiple-servers/35574/3 "2015-11-26T05:59:01Z")

</div>

I've checked the forwarder logs at /var/log/logstash-forwarder/logstash-forwarder.err. Nothing to indicate a connection was made to a server other than the intended one.

{

"network": {

"servers": ["[elkserver.softlayer.com:5043](http://elkserver.softlayer.com:5043)" ],  
"ssl ca": "/etc/pki/tls/certs/logstash-forwarder.crt",  
"timeout": 15

}  
}  
This is the complete network configuraiton. The file paths are in separate conf files.  
As mentioned earlier the network configuration is exactly the same in every environment (including the server name). We did this to avoid generating a unique ssl certificate for every environment (i know not a good thing). So the ssl certificate was generated with host name "[elkserver.softlayer.com](http://elkserver.softlayer.com)"  
So the /etc/hosts in each environment would have the required mapping:

158.23.115.123 [elkserver.softlayer.com](http://elkserver.softlayer.com) elkserver

The IP of elkserver speciifed above would change in every environment.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:21am UTC](https://discuss.elastic.co/t/logstash-forwarder-is-sending-a-message-to-multiple-servers/35574/4 "2017-07-06T05:21:11Z")

</div>