# Send one event in one packet

**URL:** <https://discuss.elastic.co/t/send-one-event-in-one-packet/135898>\
**Category:** Logstash\
**Created:** [June 14, 2018, 10:15am UTC](https://discuss.elastic.co/t/send-one-event-in-one-packet/135898 "2018-06-14T10:15:03Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Raul\_Uria](https://avatars.discourse-cdn.com/v4/letter/r/76d3ee/32.png) [@Raul\_Uria](https://discuss.elastic.co/u/Raul_Uria)\
**Post date:** [June 14, 2018, 10:15am UTC](https://discuss.elastic.co/t/send-one-event-in-one-packet/135898/1 "2018-06-14T10:15:03Z")

</div>

Hi all,  
I´m trying to use logstash to collect some data from a legacy shipper using tcp connection. Each event is in a tcp packet.

I want to filter some features and output the result event, but I need to put just one event in just one TCP output packet. Is there a way to do that?

I think of pipeline.batch.size to 1, but seems to be only for input, is there something similar for tcp output plugin?

---

<div class="post-metadata">

**Author:** ![rcowart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rcowart/32/88091_2.png) [@rcowart](https://discuss.elastic.co/u/rcowart)\
**Post date:** [June 14, 2018, 12:19pm UTC](https://discuss.elastic.co/t/send-one-event-in-one-packet/135898/2 "2018-06-14T12:19:33Z")

</div>

What have you tried so far, and what were the results? It be easier to help if you were a bit more specific.

---

<div class="post-metadata">

**Author:** ![Raul\_Uria](https://avatars.discourse-cdn.com/v4/letter/r/76d3ee/32.png) [@Raul\_Uria](https://discuss.elastic.co/u/Raul_Uria)\
**Post date:** [June 14, 2018, 3:05pm UTC](https://discuss.elastic.co/t/send-one-event-in-one-packet/135898/3 "2018-06-14T15:05:46Z")

</div>

My end of event (delimiter) is ";" (not carriage return)  
new\_message is an "enriched message" by filters plugins.

With this configuration, when two or more events arrive in less than ¿1 second? output send them in just one TCP packet, all together (I can see this with wireshark or tcpdump)

My intention is to send out three packets if three events arrive, four packets for four events, and so on..., just one per event.

```
input
{
	tcp {
		host => "0.0.0.0"
		mode => "server"
		port => 9998
		codec =>
					line {
						charset => "UTF-8"
						delimiter => ";"
					}
	}
}
filter { ... }

output {
	tcp {
		host => "x.y.z.w"
		port => "9995"
		mode => "client"
		reconnect_interval => "10"
		codec =>
				line {
						format => "%{new_message}"
				}
	}
}
```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 14, 2018, 4:43pm UTC](https://discuss.elastic.co/t/send-one-event-in-one-packet/135898/4 "2018-06-14T16:43:46Z")

</div>

> [@Raul\_Uria](#):
>
> With this configuration, when two or more events arrive in less than ¿1 second? output send them in just one TCP packet, all together (I can see this with wireshark or tcpdump)
> 
> My intention is to send out three packets if three events arrive, four packets for four events, and so on..., just one per event.

TCP is a stream oriented protocol. It does not have any conception of packets. The underlying transport (e.g. Ethernet) does, but TCP does not. You need to provide a way divide the stream up into events, which you do using the codec.

Even if you turn off the batching and constantly push data (and the standard output does not support TCP PSH) any TCP stack that handles the data may recombine packets. You cannot impose packet support on TCP like this.

---

<div class="post-metadata">

**Author:** ![Raul\_Uria](https://avatars.discourse-cdn.com/v4/letter/r/76d3ee/32.png) [@Raul\_Uria](https://discuss.elastic.co/u/Raul_Uria)\
**Post date:** [June 14, 2018, 8:01pm UTC](https://discuss.elastic.co/t/send-one-event-in-one-packet/135898/5 "2018-06-14T20:01:14Z")

</div>

I know it, but my legacy shipper is working that way since years ago, and I am not able to change it right now.

Anyway, thank you.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 12, 2018, 8:01pm UTC](https://discuss.elastic.co/t/send-one-event-in-one-packet/135898/6 "2018-07-12T20:01:18Z")

</div>

Closed on July 12, 2018, 8:01pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.