# Logstash Skipping Events from Logcourier in Linux

**URL:** <https://discuss.elastic.co/t/logstash-skipping-events-from-logcourier-in-linux/43001>\
**Category:** Logstash\
**Created:** [February 29, 2016, 1:03pm UTC](https://discuss.elastic.co/t/logstash-skipping-events-from-logcourier-in-linux/43001 "2016-02-29T13:03:08Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![rajkamalkool6](https://avatars.discourse-cdn.com/v4/letter/r/e9c0ed/32.png) [@rajkamalkool6](https://discuss.elastic.co/u/rajkamalkool6)\
**Post date:** [February 29, 2016, 1:03pm UTC](https://discuss.elastic.co/t/logstash-skipping-events-from-logcourier-in-linux/43001/1 "2016-02-29T13:03:08Z")

</div>

I have deployed 3 logstash configuration files in my server which is processing 3 different kinds of log files(.xml,.log and .txt). I am using 3 logurier files(version 1.6) to fetch the log files and logstash(version 1.5.4) to process the log files. Daily I am getting tons of log files, log courier fetching all the log files from the location but my logstash skips many events.

I am running the setup in my redhat linux 3.10.0-229.e17.x86\_64 version and JDK 1.7. Am I missing any thing to sort out this issue.

**My logstash file:**

> input {  
> courier {  
> port =\> xxxx  
> transport =\> "tcp"

> ```
> }
> 
> ```
> 
> }  
> filter{  
> .....  
> }  
> output{  
> elasticsearch {  
> index =\> "logstash-server1-%{+YYYY.MM.dd}"  
> host =\> "XXXXXX"  
> cluster =\> "server\_cluster"  
> protocol =\> "http"  
> document\_id =\> "%{fingerprint}"  
> }  
> }

**Logcourier File:**

> {  
> "general": {  
> "log level" : "debug",  
> "persist directory" : "\<.logcourier file location\>"  
> },  
> "network": {  
> "servers": ["127.0.0.1:xxxx"],  
> "transport": "tcp"  
> },

> "files": [  
> {  
> "paths":[  
> "/Mylogdata/error/[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]/vg67-\*.xml"

> ```
> ],
> "fields": { "type": "sss_log" },
> "codec": {
> "name": "multiline",
> "pattern":"<regular expression>",
> "negate": true,
> "what": "next"
> },
> "dead time": "1s",
> 
> ```

> ```
> }
> ]
> 
> ```
> 
> }

Do I need to add any additional property to overcome this issue.. I am using the same configuration for all the 3 configuration files(Logstash and Logcourier)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:09am UTC](https://discuss.elastic.co/t/logstash-skipping-events-from-logcourier-in-linux/43001/2 "2017-07-06T05:09:19Z")

</div>

Closed on July 6, 2017, 5:09am UTC