I have configured logstash with a TCP gelf output. However, if the TCP connection cannot be established (e.g graylog is down or hasn't yet been configured to listen on the port), the pipeline aborts and logstash shuts down.
Is that the expected behaviour? Should it not be retrying to connect rather than going down and requiring manual intervention?
Unfortunately yes. If it is able to connect at startup and gelf restarts I do not think it will recover from that either. Using UDP rather than TCP avoids these issues but brings a whole other set of problems (security, reliability etc.)
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.