Logstash TCP unable to work

Elastic Stack Logstash
1

I would like to work with 2 logstash and I have made the setting in the file pipeline.yml
My pipeline.yml:

- pipeline.id: input_pipeline_1
  path.config: "config/Logstash1.conf"
  pipeline.workers: 3

- pipeline.id: forward_to_ES_pipeline_1
  path.config: "testC/Logstash2.conf"
  queue.type: persisted

I was trying to receive msg from a logstash1 with a TCP port (e.g. 7979) and proceed filtering msg then send to a port (e.g. 5044) while the logstash2 received the msg from port 5044 and send it to Elasticseach.
The problem looks like the msg is unable to received msg from the 1st logstash because I have try send the msg to port 5044 and logstash2 is able to receive the msg and proceed to Elasticsearch.

Logstash1 conf:

input {
  tcp {
    port => 7979
    host => "10.61.35.162"
  }
}
filter {
  ##Filtering
}
output {
  tcp {
    port => 5044
    host => "10.61.35.162"
  }
}

Logstash2.conf:

input {
  tcp {
    port => 5044
    mode => "server"
  }
}
output {
  elasticsearch {
    hosts => ["http://10.61.35.162:9200/"]
    index => "testing123"
  }
  stdout { codec => rubydebug }
}

I also tried the same port with 2 logstash and it didn't work as well. How can I solve the problems ?

**I use ncat command for sending msg to particular port number. Example of my command

echo Testing123 | ncat --send-only 10.61.35.162 <port Number>

**The purpose of 2 logstash is I want to test the SSL security and try to sniff the packet for testing security of the communication.

2

Impossible to say unless you explain what the problems are. Also, please format your post using markdown.

3

I have made the edit to the post. My problem is why Logstash1 is unable to receive the msg input ?

4

If you are saying that the tcp input on port 7979 is not flushing an event that would most likely be because it does not contain a newline.

Does

echo "Testing123
" | ncat ...

work any better?

Also, are you sure logstash2 is listening on 10.61.35.162:5044? I have known strange operating systems where the default 0.0.0.0 did not include private networks like 10/24 (which is a superset of 10.61.35.162).

5

I tried but it is still the same.

Beside, I am sure logstash2 port 5044 is listening since it shows in netstat -tlpn command and it received the msg with echo testing123 | ncat --send-only 10.61.35.162 5044 .

So I think the problems is receiving the msg from Logstash1

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.