Logstash - wrong codec in tcp input plugin?

This because the #fix_streaming_codecs changes it for JSONLines and Lines, see https://github.com/elastic/logstash/blob/0d1011980efc2fdae9b8e8a261b8d04f6ff537de/logstash-core/lib/logstash/inputs/base.rb#L122-L135

Because in this input we assume that an event is separated by a new line, if you were using the plain or the json codec, the plugin would never know when or where to split the events and will just keep buffering data. For the user experience we make the assumptions that your events will be split by \n, but you can change that behavior in both codec by configuring the delimiter option, see the jsonlines documentation

1 Like