# Logstash shuts down if gelf output TCP connection is refused

**URL:** <https://discuss.elastic.co/t/logstash-shuts-down-if-gelf-output-tcp-connection-is-refused/248132>\
**Category:** Logstash\
**Created:** [September 10, 2020, 8:34am UTC](https://discuss.elastic.co/t/logstash-shuts-down-if-gelf-output-tcp-connection-is-refused/248132 "2020-09-10T08:34:31Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Samuel\_Delepiere](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/samuel_delepiere/32/75345_2.png) [@Samuel\_Delepiere](https://discuss.elastic.co/u/Samuel_Delepiere)\
**Post date:** [September 10, 2020, 8:34am UTC](https://discuss.elastic.co/t/logstash-shuts-down-if-gelf-output-tcp-connection-is-refused/248132/1 "2020-09-10T08:34:31Z")

</div>

I have configured logstash with a TCP gelf output. However, if the TCP connection cannot be established (e.g graylog is down or hasn't yet been configured to listen on the port), the pipeline aborts and logstash shuts down.  
Is that the expected behaviour? Should it not be retrying to connect rather than going down and requiring manual intervention?

Thanks

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [September 10, 2020, 3:09pm UTC](https://discuss.elastic.co/t/logstash-shuts-down-if-gelf-output-tcp-connection-is-refused/248132/2 "2020-09-10T15:09:49Z")

</div>

> [@Samuel\_Delepiere](#):
>
> Is that the expected behaviour?

Unfortunately yes. If it is able to connect at startup and gelf restarts I do not think it will recover from that either. Using UDP rather than TCP avoids these issues but brings a whole other set of problems (security, reliability etc.)

---

<div class="post-metadata">

**Author:** ![Samuel\_Delepiere](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/samuel_delepiere/32/75345_2.png) [@Samuel\_Delepiere](https://discuss.elastic.co/u/Samuel_Delepiere)\
**Post date:** [September 11, 2020, 7:58am UTC](https://discuss.elastic.co/t/logstash-shuts-down-if-gelf-output-tcp-connection-is-refused/248132/3 "2020-09-11T07:58:28Z")

</div>

Thanks for the confirmation. Would an enhancement be possible to retry to connect every X seconds?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [September 11, 2020, 1:19pm UTC](https://discuss.elastic.co/t/logstash-shuts-down-if-gelf-output-tcp-connection-is-refused/248132/4 "2020-09-11T13:19:03Z")

</div>

It could be done, but I do not see anyone volunteering to do it.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 9, 2020, 1:19pm UTC](https://discuss.elastic.co/t/logstash-shuts-down-if-gelf-output-tcp-connection-is-refused/248132/5 "2020-10-09T13:19:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.