# Tcp input writing too much data in log

**URL:** <https://discuss.elastic.co/t/tcp-input-writing-too-much-data-in-log/24594>\
**Category:** Logstash\
**Created:** [June 30, 2015, 5:58am UTC](https://discuss.elastic.co/t/tcp-input-writing-too-much-data-in-log/24594 "2015-06-30T05:58:36Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![Wurzelmann](https://avatars.discourse-cdn.com/v4/letter/w/b9bd4f/32.png) [@Wurzelmann](https://discuss.elastic.co/u/Wurzelmann)\
**Post date:** [June 30, 2015, 5:58am UTC](https://discuss.elastic.co/t/tcp-input-writing-too-much-data-in-log/24594/1 "2015-06-30T05:58:36Z")

</div>

I started using four tcp inputs simultaneously and I noticed the logs (var/log/logstash/logstash.log) getting bigger and bigger since then. My log is around 28 GB currently, because everything logstash outputs to elasticsearch, it also outputs into this log file (only the tcp inputs though). Is this normal behaviour?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [June 30, 2015, 6:06am UTC](https://discuss.elastic.co/t/tcp-input-writing-too-much-data-in-log/24594/2 "2015-06-30T06:06:12Z")

</div>

It's not.

Can we see your config?

---

<div class="post-metadata">

**Author:** ![Wurzelmann](https://avatars.discourse-cdn.com/v4/letter/w/b9bd4f/32.png) [@Wurzelmann](https://discuss.elastic.co/u/Wurzelmann)\
**Post date:** [June 30, 2015, 6:38am UTC](https://discuss.elastic.co/t/tcp-input-writing-too-much-data-in-log/24594/3 "2015-06-30T06:38:39Z")

</div>

Which config do you need? The one containing the output or all the ones with tcp inputs?

EDIT: To specify: my only output is to elasticsearch, nonetheless logstash seems to log every incoming message into its own logs... according to [this](https://logstash.jira.com/browse/LOGSTASH-1086?focusedCommentId=17296&page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-17296) it could be because of errors in the config?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 30, 2015, 7:25am UTC](https://discuss.elastic.co/t/tcp-input-writing-too-much-data-in-log/24594/4 "2015-06-30T07:25:33Z")

</div>

You're starting Logstash with `--verbose` or `--debug`. Don't 😄

---

<div class="post-metadata">

**Author:** ![Wurzelmann](https://avatars.discourse-cdn.com/v4/letter/w/b9bd4f/32.png) [@Wurzelmann](https://discuss.elastic.co/u/Wurzelmann)\
**Post date:** [June 30, 2015, 7:38am UTC](https://discuss.elastic.co/t/tcp-input-writing-too-much-data-in-log/24594/5 "2015-06-30T07:38:04Z")

</div>

No, I do not use `--verbose` or `--debug`.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 30, 2015, 7:45am UTC](https://discuss.elastic.co/t/tcp-input-writing-too-much-data-in-log/24594/6 "2015-06-30T07:45:15Z")

</div>

Well, either you have a stdout output in your configuration (perhaps in an extra file in /etc/logstash/conf.d?) or it's coming from the logging. What do the logs look like?

---

<div class="post-metadata">

**Author:** ![Wurzelmann](https://avatars.discourse-cdn.com/v4/letter/w/b9bd4f/32.png) [@Wurzelmann](https://discuss.elastic.co/u/Wurzelmann)\
**Post date:** [June 30, 2015, 9:47am UTC](https://discuss.elastic.co/t/tcp-input-writing-too-much-data-in-log/24594/7 "2015-06-30T09:47:08Z")

</div>

I have only one output and it looks like this;

`output { elasticsearch { cluster => "name" host => "localhost" index => "%{type}-%{+YYYY.MM.dd}" } }`

I just managed to reduce the messages written to the log by replacing two tcp inputs with syslog inputs.

It seems that the remaining log operations are being written because of some encoding error in our filter, which processes Windows Events. I'm going to fix that and update this thread accordingly.

Thank you!

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [June 30, 2015, 9:05pm UTC](https://discuss.elastic.co/t/tcp-input-writing-too-much-data-in-log/24594/8 "2015-06-30T21:05:18Z")

</div>

If you can provide a sample of the log it will help.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:35am UTC](https://discuss.elastic.co/t/tcp-input-writing-too-much-data-in-log/24594/9 "2017-07-06T05:35:57Z")

</div>

Closed on July 6, 2017, 5:35am UTC