# Logstash to Logstash Not Working **URL:** \ **Category:** Logstash\ **Created:** [January 26, 2017, 12:25am UTC](https://discuss.elastic.co/t/logstash-to-logstash-not-working/72840 "2017-01-26T00:25:44Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![kopacko](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kopacko/32/10733_2.png) [@kopacko](https://discuss.elastic.co/u/kopacko)\ **Post date:** [January 26, 2017, 12:25am UTC](https://discuss.elastic.co/t/logstash-to-logstash-not-working/72840/1 "2017-01-26T00:25:44Z")
I have a Logstash server with a tcp output configured: ``` output { tcp { host => "x.x.x.x" port => 12345 codec => json } } ``` On a receiving Logstash box, I have a tcp input configured and I am adding a couple fields for tracking purposes: ``` input { tcp { port => 12345 codec => json add_field => ["field", "DATA"] } } ``` On the receiving Logstash server, via tcpdump, I can see the messages coming in: ``` 19:19:24.999659 IP (tos 0x0, ttl 62, id 40830, offset 0, flags [DF], proto TCP (6), length 931) x.x.x.x.49652 > x.x.x.x.12345: Flags [P.], cksum 0x520c (correct), seq 44933:45812, ack 1, win 1460, options [nop,nop,TS val 3021847556 ecr 832838], length 879 E....~@.>.s. . . e B....5`.lY.......R...... .......F{"pipeline_protocol":"udp","syslog_severity_code":6,"syslog_body":"SFR requested ASA to bypass further packet redirection and process TCP flow from inside:x.x.x.x/55349 to outside:x.x.x.x/443 locally\n","city":"#####","syslog_facility":"LOCAL0","syslog_facility_code":16,"device_type":"Cisco ASA","message":"<13>Jan 25 18:19:24.670162 x.x.x.x <134>Jan 25 2017 18:19:24 ##### : %ASA-6-434004: SFR requested ASA to bypass further packet redirection and process TCP flow from inside:x.x.x.x/55349 to outside:x.x.x.x/443 locally\n","syslog_severity":"INFORMATIONAL","pipeline":"LOGFIREWALL","device_ip":"x.x.x.x","cisco_mnemonic":"434004","pipeline_ingress":"########","hostname":"########","@timestamp":"2017-01-26T00:19:24.680Z","cisco_facility":"ASA","@version":"1","host":"x.x.x.x","cisco_severity":"6","pipeline_port":"###","syslog_pri":"134"} 19:19:24.999679 IP (tos 0x0, ttl 64, id 16160, offset 0, flags [DF], proto TCP (6), length 52) x.x.x.x.36514 > x.x.x.x.49652: Flags [.], cksum 0x26f2 (incorrect -> 0xd88e), ack 45812, win 1041, options [nop,nop,TS val 832877 ecr 3021847556], length 0 E..4? @.@... e B . .....Y...5`......&...... ...m.... ``` My Logstash output, at the moment, is this: ``` output { elasticsearch { hosts => ["http://localhost:9200"] index => "logstash-%{+YYYY.MM.dd}" user => "#####" password => "#####" } } ``` Yet, NONE of these logs are making it into ES. I have OTHER inputs defined and those logs ARE making it in just fine. I installed the X-pack so I could look at monitoring and it is showing all green. What am I missing so that the receiving Logstash server will ingest the message output from another Logstash server? ---
**Author:** ![kopacko](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kopacko/32/10733_2.png) [@kopacko](https://discuss.elastic.co/u/kopacko)\ **Post date:** [January 26, 2017, 4:21am UTC](https://discuss.elastic.co/t/logstash-to-logstash-not-working/72840/2 "2017-01-26T04:21:08Z")
As a test, I change the protocols from TCP to UDP and it works just fine. I need this to be TCP, so what am I doing wrong??? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [January 26, 2017, 7:08am UTC](https://discuss.elastic.co/t/logstash-to-logstash-not-working/72840/3 "2017-01-26T07:08:20Z")
I wonder if you perhaps need to use the json\_lines codec so that the output ends each event with a newline character. ---
**Author:** ![kopacko](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kopacko/32/10733_2.png) [@kopacko](https://discuss.elastic.co/u/kopacko)\ **Post date:** [January 26, 2017, 2:54pm UTC](https://discuss.elastic.co/t/logstash-to-logstash-not-working/72840/4 "2017-01-26T14:54:54Z")
I did try it, on the input configuration. I will try it on both sides. ---
**Author:** ![kopacko](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kopacko/32/10733_2.png) [@kopacko](https://discuss.elastic.co/u/kopacko)\ **Post date:** [January 26, 2017, 3:44pm UTC](https://discuss.elastic.co/t/logstash-to-logstash-not-working/72840/5 "2017-01-26T15:44:02Z")
Looks like json\_lines on both sides fixed it. Testing with another box to verify. ---
**Author:** ![kopacko](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kopacko/32/10733_2.png) [@kopacko](https://discuss.elastic.co/u/kopacko)\ **Post date:** [January 26, 2017, 4:46pm UTC](https://discuss.elastic.co/t/logstash-to-logstash-not-working/72840/6 "2017-01-26T16:46:51Z")
Magnus, That did the trick. All my Logstash to Logstash logs are now being processed. Thank you!!!! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 23, 2017, 4:47pm UTC](https://discuss.elastic.co/t/logstash-to-logstash-not-working/72840/7 "2017-02-23T16:47:14Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.