# Tcp logstash encoder

**URL:** <https://discuss.elastic.co/t/tcp-logstash-encoder/103051>\
**Category:** Logstash\
**Created:** [October 6, 2017, 5:14pm UTC](https://discuss.elastic.co/t/tcp-logstash-encoder/103051 "2017-10-06T17:14:24Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![visioncoder](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/visioncoder/32/22842_2.png) [@visioncoder](https://discuss.elastic.co/u/visioncoder)\
**Post date:** [October 6, 2017, 5:14pm UTC](https://discuss.elastic.co/t/tcp-logstash-encoder/103051/1 "2017-10-06T17:14:25Z")

</div>

Hello,

I am using tcp-logstash-encoder 4.11 with SpringBoot 1.5.6. to push json log messages to Logstash. Some select messages are coming through fine but most are not. Console is printing all the messages.

The TCP connection itself looks to be good so it does not seem to be the case of dropped messages.

Does Logstash store error records (grokparsefailure) anywhere if it is not specified? Is there a way for me to keep track of "failed" records - the ones that reached Logstash but never made it to ES?

The relevant input and output configurations are below:

```
  tcp {
        port => 9202
        type => "mbo_lower"
        tags => ["mbo"]
        codec => json_lines
    }

 if [host] =~ /^(nameA|nameB).*$/ {
            if [host] =~ /^(nameA|nameB)\w*\-\w*\-\w*\d+[p]\..*$/ {
                elasticsearch {
                    index => "indexA-%{+YYYY.MM.dd}"
                    hosts => ["xxxx:9200"]
                    user => "oneUser"
                    password => "onePassword"
                }
            } else {
                elasticsearch {
                    index => "indexB-%{+YYYY.MM.dd}"
                    hosts => ["xxxx9200"]
                    user => "oneUser"
                    password => "onePassword"
                }
            }

```

Please let me know if additional information is required from my end.

Thanks!

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 10, 2017, 5:34am UTC](https://discuss.elastic.co/t/tcp-logstash-encoder/103051/2 "2017-10-10T05:34:18Z")

</div>

Have you looked in the Logstash logs? What if you comment out the elasticsearch output and just use a stdout or file output, are you then getting all events?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 7, 2017, 5:34am UTC](https://discuss.elastic.co/t/tcp-logstash-encoder/103051/3 "2017-11-07T05:34:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.