# Logstash TCP unable to work

**URL:** <https://discuss.elastic.co/t/logstash-tcp-unable-to-work/222092>\
**Category:** Logstash\
**Created:** [March 4, 2020, 1:47pm UTC](https://discuss.elastic.co/t/logstash-tcp-unable-to-work/222092 "2020-03-04T13:47:28Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![kopilim96](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kopilim96/32/63260_2.png) [@kopilim96](https://discuss.elastic.co/u/kopilim96)\
**Post date:** [March 4, 2020, 1:47pm UTC](https://discuss.elastic.co/t/logstash-tcp-unable-to-work/222092/1 "2020-03-04T13:47:28Z")

</div>

I would like to work with 2 logstash and I have made the setting in the file pipeline.yml  
My pipeline.yml:

```auto
- pipeline.id: input_pipeline_1
  path.config: "config/Logstash1.conf"
  pipeline.workers: 3

- pipeline.id: forward_to_ES_pipeline_1
  path.config: "testC/Logstash2.conf"
  queue.type: persisted

```

I was trying to receive msg from a logstash1 with a TCP port (e.g. 7979) and proceed filtering msg then send to a port (e.g. 5044) while the logstash2 received the msg from port 5044 and send it to Elasticseach.  
The problem looks like the msg is unable to received msg from the 1st logstash because I have try send the msg to port 5044 and logstash2 is able to receive the msg and proceed to Elasticsearch.

Logstash1 conf:

```auto
input {
  tcp {
    port => 7979
    host => "10.61.35.162"
  }
}
filter {
  ##Filtering
}
output {
  tcp {
    port => 5044
    host => "10.61.35.162"
  }
}

```

Logstash2.conf:

```auto
input {
  tcp {
    port => 5044
    mode => "server"
  }
}
output {
  elasticsearch {
    hosts => ["http://10.61.35.162:9200/"]
    index => "testing123"
  }
  stdout { codec => rubydebug }
}

```

I also tried the same port with 2 logstash and it didn't work as well. How can I solve the problems ?

\*\*I use ncat command for sending msg to particular port number. Example of my command

```auto
echo Testing123 | ncat --send-only 10.61.35.162 <port Number>

```

\*\*The purpose of 2 logstash is I want to test the SSL security and try to sniff the packet for testing security of the communication.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 4, 2020, 5:55pm UTC](https://discuss.elastic.co/t/logstash-tcp-unable-to-work/222092/2 "2020-03-04T17:55:33Z")

</div>

> [@kopilim96](#):
>
> How can I solve the problems ?

Impossible to say unless you explain what the problems are. Also, please format your post using [markdown](https://github.com/adam-p/markdown-here/wiki/Markdown-Cheatsheet).

---

<div class="post-metadata">

**Author:** ![kopilim96](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kopilim96/32/63260_2.png) [@kopilim96](https://discuss.elastic.co/u/kopilim96)\
**Post date:** [March 5, 2020, 3:22am UTC](https://discuss.elastic.co/t/logstash-tcp-unable-to-work/222092/3 "2020-03-05T03:22:07Z")

</div>

I have made the edit to the post. My problem is why `Logstash1` is unable to receive the msg input ?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 5, 2020, 3:32am UTC](https://discuss.elastic.co/t/logstash-tcp-unable-to-work/222092/4 "2020-03-05T03:32:03Z")

</div>

If you are saying that the tcp input on port 7979 is not flushing an event that would most likely be because it does not contain a newline.

Does

```
echo "Testing123
" | ncat ...

```

work any better?

Also, are you sure logstash2 is listening on 10.61.35.162:5044? I have known strange operating systems where the default 0.0.0.0 did not include private networks like 10/24 (which is a superset of 10.61.35.162).

---

<div class="post-metadata">

**Author:** ![kopilim96](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kopilim96/32/63260_2.png) [@kopilim96](https://discuss.elastic.co/u/kopilim96)\
**Post date:** [March 5, 2020, 6:17am UTC](https://discuss.elastic.co/t/logstash-tcp-unable-to-work/222092/5 "2020-03-05T06:17:15Z")

</div>

I tried but it is still the same.

Beside, I am sure `logstash2` port 5044 is listening since it shows in `netstat -tlpn` command and it received the msg with `echo testing123 | ncat --send-only 10.61.35.162 5044 `.

So I think the problems is receiving the msg from `Logstash1`

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 2, 2020, 6:17am UTC](https://discuss.elastic.co/t/logstash-tcp-unable-to-work/222092/6 "2020-04-02T06:17:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.