# Logstash stops processing the logs after sometime for tcp input **URL:** \ **Category:** Logstash\ **Created:** [February 25, 2019, 11:44am UTC](https://discuss.elastic.co/t/logstash-stops-processing-the-logs-after-sometime-for-tcp-input/169818 "2019-02-25T11:44:25Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![vsskrishna](https://avatars.discourse-cdn.com/v4/letter/v/bb73d2/32.png) [@vsskrishna](https://discuss.elastic.co/u/vsskrishna)\ **Post date:** [February 25, 2019, 11:44am UTC](https://discuss.elastic.co/t/logstash-stops-processing-the-logs-after-sometime-for-tcp-input/169818/1 "2019-02-25T11:44:26Z")
Hi, In my ELK stack(5.6.1), I have configured my logstash to listen on both TCP(5000) and filebeat(5044) input. Logs coming from filebeat is working fine but logs coming from TCP stops after some time without any error. I have checked the logstash logs in debug mode but couldn't find any error logs. A python script is used to send logs to TCP port. When I ran the script, logstash logs shows the below debug log `[DEBUG][logstash.pipeline] output received {"event"=>{"vid"=>"vutus", "@timestamp"=>2019-02-25T11:26:16.483Z, "port"=>49116, "@version"=>"1", "host"=>"x.x.x.x", "id"=>"1234567890", "message"=>"This is dummy message to test the logstash by vutus", "aws"=>{"invoked_function_arn"=>"lambda_funtion_arn", "memory_limit_in_mb"=>"1.1MB", "function_version"=>"1.0", "function_name"=>"lambda_funtion"}, "timestamp"=>"Fri Feb 22 06:57:08 2019"}}` After some time when the logstash stops processing the application logs, I ran the python script manually and I couldn't find any log in the logstash logs(like described above). But the python script is run successfully. I have checked the memory and CPU but there are no issues. The python script that I have used is > s = socket.socket(socket.AF\_INET, socket.SOCK\_STREAM) > s.connect((HOST, PORT)) > s.send((json.dumps(log\_entry)+ "\n").encode("UTF-8")) > #(log\_entry is json formated log) logstash configuration is ``` input { tcp { port => 5000 codec => json } beats{ port => 5044 } } ``` Can anyone give me the right direction to solve this? ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [February 25, 2019, 1:12pm UTC](https://discuss.elastic.co/t/logstash-stops-processing-the-logs-after-sometime-for-tcp-input/169818/2 "2019-02-25T13:12:17Z")
What does the rest of the configuration look like? It sounds like the output is having issues, resulting in back-pressure on the input which prevents it reading anything more. ---
**Author:** ![vsskrishna](https://avatars.discourse-cdn.com/v4/letter/v/bb73d2/32.png) [@vsskrishna](https://discuss.elastic.co/u/vsskrishna)\ **Post date:** [February 26, 2019, 7:06am UTC](https://discuss.elastic.co/t/logstash-stops-processing-the-logs-after-sometime-for-tcp-input/169818/3 "2019-02-26T07:06:12Z")
Thanks for the reply. There are no filters in my config. The output of my config looks like ``` output { if [type] == "rules" or [type] == "alert" or [type] == "alertsecurity" or [type] =~ /tomcat[0-9]-prpc-[a-z,-]*/ { elasticsearch { hosts => "${ESURL_PORT_9200_TCP_ADDR}:9200" manage_template => false index => "prpc" } } else if [type] == "catalina" or [type] =~ /tomcat[0-9]-[a-z]*/ { elasticsearch { hosts => "${ESURL_PORT_9200_TCP_ADDR}:9200" manage_template => false index => "tomcat" } } else if [type] =~ /haproxy-[a-z]*/ { elasticsearch { hosts => "${ESURL_PORT_9200_TCP_ADDR}:9200" manage_template => false index => "haproxy" } } else if [type] == "postgres" or [type] =~ /postgres-[a-z]*/ { elasticsearch { hosts => "${ESURL_PORT_9200_TCP_ADDR}:9200" manage_template => false index => "db" } } else if [type] == "bitbucketlog" { elasticsearch { hosts => "${ESURL_PORT_9200_TCP_ADDR}:9200" manage_template => false index => "bitbucketlog" } } else if [type] == "syslog" { elasticsearch { hosts => "${ESURL_PORT_9200_TCP_ADDR}:9200" manage_template => false index => "syslog" } } else { elasticsearch { hosts => "${ESURL_PORT_9200_TCP_ADDR}:9200" manage_template => false index => "cloudwatch" } } ``` When I check it thoroughly, I find that all my logs are getting pushed with \_dateparseerror tag. So I have just corrected it and now all the logs are pushing without any error tag. is this related to the issue that I am facing? ---
**Author:** ![vsskrishna](https://avatars.discourse-cdn.com/v4/letter/v/bb73d2/32.png) [@vsskrishna](https://discuss.elastic.co/u/vsskrishna)\ **Post date:** [February 28, 2019, 6:04am UTC](https://discuss.elastic.co/t/logstash-stops-processing-the-logs-after-sometime-for-tcp-input/169818/4 "2019-02-28T06:04:07Z")
Once I have fixed the dateparseerror of my logs, so far I have not encounter this issue. I think logs with dateparse error was the the problem. Thanks @Badger ---
**Author:** ![vsskrishna](https://avatars.discourse-cdn.com/v4/letter/v/bb73d2/32.png) [@vsskrishna](https://discuss.elastic.co/u/vsskrishna)\ **Post date:** [March 18, 2019, 6:23am UTC](https://discuss.elastic.co/t/logstash-stops-processing-the-logs-after-sometime-for-tcp-input/169818/5 "2019-03-18T06:23:51Z")
Issue is still exist. There are no error logs in logstash logs. It seems that there are no parsing error. I have observe this issue after 2 days from the day that I have put this logstash in production. Could you please point me in any other direction. If you need any other information, please let me know. Thanks in advance. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 15, 2019, 6:23am UTC](https://discuss.elastic.co/t/logstash-stops-processing-the-logs-after-sometime-for-tcp-input/169818/6 "2019-04-15T06:23:52Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.