TCP input and http output plugin configuration is not working

Elastic Stack Logstash
1

Hi,

I am running logstash with tcp input and http output plugin(which is sending to another logstash from which it would be to ES) and I don't see any logs in ES. But when I replace tcp plugin with udp, I see logs in ES. Logstash logs don't say anything here.

Can someone please explain me what the issue is?

Thanks

2

What does your configuration look like? When using the tcp input, is Logstash actually listening on a network interface that's accessible to whatever is attempting to send data? Have you tried sending data by hand with e.g. telnet or netcat?

Also, simplify your setup while debugging the problem. Reconfigure the first Logstash instance to only have a stdout { codec => rubydebug } output.

4

Hi Magnus,

My config is something like,

input {
  tcp {
     host => "nodename"
     port => 514
     type => "syslog"
  }
}
filter{
...
}
output{
http {
			url=> "http://xxx.xx.xx:443"
			http_method=> "post"
			format=> "json"   
		}

file {
                       path => "/tmp/logstash/output.log"
                }

}
}

Log source for this logstash is coming from Syslog server over tcp port 514(will be changed to udp whenever needed).

I observed one more weird thing here- when using tcp input plugin, it's able to write to file but not sending anything over http output plugin.

When tcp input plugin is replaced by udp input plugin, output is being written to both file and over http output plugin.

Please let me know if something is not clear.

5

Are you running Logstash as root or implementing a workaround to get Logstash to listen on port 514?

  	url=> "http://xxx.xx.xx:443"

Surely it's https on port 443.

I repeat:

  • Have you tried sending data by hand with e.g. telnet or netcat?
  • Also, simplify your setup while debugging the problem. Reconfigure the first Logstash instance to only have a stdout { codec => rubydebug } output.
6

Yes, I am running Logstash as root

Do I need to use https instead of http? But it is working with http too(except when I change my input plugin to tcp)

since my data is getting stored on local file when using tcp input plugin, do I still need to send data by hand?

7

Do I need to use https instead of http? But it is working with http too(except when I change my input plugin to tcp)

That's surprising, but you should make sure the protocol declaration matches reality (so you should probably use https://).

since my data is getting stored on local file when using tcp input plugin, do I still need to send data by hand?

Probably not since the data appears to reach the Logstash pipeline.

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.