Syslog load balancing in front of Logstash?

There is a long thread on github about this behavior with rsyslog and multiple tools, I don't think this is restricted to HAProxy.

It seems that the issue originates by the connection being closed between the packets and rsyslog needing to start a new connection, on the thread some people solved it by using keep alive on the receiver side.

There is not much you can do on Logstash side, but there is an option to enable tcp keel alive, you can try adding tcp_keep_alive => true in your input to see if it helps.

This is not an issue with Logstash, so not sure if you will get much help here as this forum is focused on Elastic tool, but maybe someone has a similar scenario and was able to solve it.