# Logstash TCP encoder

**URL:** <https://discuss.elastic.co/t/logstash-tcp-encoder/353469>\
**Category:** Logstash\
**Created:** [February 16, 2024, 1:44pm UTC](https://discuss.elastic.co/t/logstash-tcp-encoder/353469 "2024-02-16T13:44:06Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![kypdk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kypdk/32/131768_2.png) [@kypdk](https://discuss.elastic.co/u/kypdk)\
**Post date:** [February 16, 2024, 1:44pm UTC](https://discuss.elastic.co/t/logstash-tcp-encoder/353469/1 "2024-02-16T13:44:07Z")

</div>

The logs go to the logstash server, but they are not indexed because they are not in the format I want.

How should I configure it?

```auto
output {

        elasticsearch {
                hosts => "elasticsearch:9200"
                manage_template => true
                index => "%{[fields][app]}"
        }
}

```

```auto
            //LOGSTASH TCP
            LogstashTcpSocketAppender logstashTcpSocketAppender = new LogstashTcpSocketAppender();
            logstashTcpSocketAppender.setName("TCP_LOG");
            logstashTcpSocketAppender.setContext(loggerContext);
            logstashTcpSocketAppender.addDestination("localhost:5000");
            logstashTcpSocketAppender.setEncoder(new EncoderJSON());
            logstashTcpSocketAppender.start();

            rootLogger.addAppender(logstashTcpSocketAppender);

```

```auto
import ch.qos.logback.classic.spi.ILoggingEvent;
import com.fasterxml.jackson.databind.ObjectMapper;
import net.logstash.logback.encoder.LogstashEncoder;

import java.nio.charset.StandardCharsets;
import java.text.SimpleDateFormat;
import java.util.*;

public class EncoderJSON extends LogstashEncoder {

    private final ObjectMapper objectMapper = new ObjectMapper();
    @Override
    public byte[] encode(ILoggingEvent event) {

        
        SimpleDateFormat dateFormat = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss.SSS");

        try {

            String timestamp = dateFormat.format(new Date(event.getTimeStamp()));
            String threadName = event.getThreadName();
            String level = event.getLevel().toString();
            String loggerName = event.getLoggerName();
            String requestId = String.valueOf(event.getMDCPropertyMap().get("requestId") != null ? event.getMDCPropertyMap().get("requestId") : "");
            String message = event.getFormattedMessage();
            String exception = event.getThrowableProxy() != null ? event.getThrowableProxy().toString() : "";

            Map<String, Object> logMap = new LinkedHashMap<>();
            logMap.put("timestamp", timestamp);
            logMap.put("level", level);
            logMap.put("logId", requestId);
            logMap.put("message", message);
            logMap.put("threadName", threadName);
            logMap.put("loggerName", loggerName);
            logMap.put("exception", exception);

            Map<String, String> fields = new HashMap<>();
            fields.put("app", "test");

            logMap.put("fields",fields);
            
            String jsonLog = objectMapper.writeValueAsString(logMap) + "\n";

            return jsonLog.getBytes(StandardCharsets.UTF_8);
        } catch (Exception e) {
            e.printStackTrace();
            return new byte[0];
        }
    }
}

```

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [February 16, 2024, 2:10pm UTC](https://discuss.elastic.co/t/logstash-tcp-encoder/353469/2 "2024-02-16T14:10:48Z")

</div>

> [@kypdk](#):
>
> The logs go to the logstash server, but they are not indexed because they are not in the format I want.

Do you have any errors in Logstash? Logs not being indexed is a Elasticsearch issue that will generate an error log in Logstash as well.

What does your logstash pipeline looks like? You only shared the output.

Also, what does your output looks like?

---

<div class="post-metadata">

**Author:** ![kypdk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kypdk/32/131768_2.png) [@kypdk](https://discuss.elastic.co/u/kypdk)\
**Post date:** [February 16, 2024, 9:47pm UTC](https://discuss.elastic.co/t/logstash-tcp-encoder/353469/3 "2024-02-16T21:47:38Z")

</div>

Badly formatted index, after interpolation still contains placeholder: [%{[fields][app]}]

The reason why it gives this error is that the encoderJSON class did not do its job, otherwise it would have added the fields and logstash would have captured the syntax in the output.

How do I implement LogstashTcpSocketAppender encoder

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [February 17, 2024, 3:54pm UTC](https://discuss.elastic.co/t/logstash-tcp-encoder/353469/4 "2024-02-17T15:54:41Z")

</div>

> [@kypdk](#):
>
> The reason why it gives this error is that the encoderJSON class did not do its job, otherwise it would have added the fields and logstash would have captured the syntax in the output.

And what is the issue with Logstash? This does not seem to be an issue with Logstash, but with the code you are using to send data to Logstash, which is out of the scope of this forum.

You didn't share anything else, like what is your input, what are your filters, and what is the output that logstash is generating.

Without it is not possible to know if the issue is in your Logstash configuration or with your code.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 16, 2024, 3:55pm UTC](https://discuss.elastic.co/t/logstash-tcp-encoder/353469/5 "2024-03-16T15:55:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.