TCP output hangs while sending syslog

Hello Experts,

We facing an issue, while sending syslog event output from TCP, some times TCP hangs and then outputs the syslog event. The major problem here is that if any event comes in between for output, because TCP output is hanged, the event drops or not sent.

This behavior is happens some times more frequently

Below is the config file used

input {

syslog {
port => 1468
}
udp {
port => 514
type => syslog
}

}

output {

tcp{
host => "10.140.190.105"
port => 1468

codec => line {
format => "%{message}"
}

}

}

Please also find below the logs generated while TCP hangs

[2017-11-24T08:10:34,608][WARN ][logstash.outputs.tcp ] tcp output exception {:host=>"10.140.190.105", :port=>1468, :exception=>#<EOFError: End of file reached>, :backtrace=>["org/jruby/RubyIO.java:3030:in sysread'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-tcp-4.0.2/lib/logstash/outputs/tcp.rb:162:inregister'", "org/jruby/RubyProc.java:281:in call'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-codec-line-3.0.4/lib/logstash/codecs/line.rb:54:inencode'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-tcp-4.0.2/lib/logstash/outputs/tcp.rb:207:in receive'", "/usr/share/logstash/logstash-core/lib/logstash/outputs/base.rb:92:inmulti_receive'", "org/jruby/RubyArray.java:1613:in each'", "/usr/share/logstash/logstash-core/lib/logstash/outputs/base.rb:92:inmulti_receive'", "/usr/share/logstash/logstash-core/lib/logstash/output_delegator_strategies/single.rb:15:in multi_receive'", "org/jruby/ext/thread/Mutex.java:149:insynchronize'", "/usr/share/logstash/logstash-core/lib/logstash/output_delegator_strategies/single.rb:14:in multi_receive'", "/usr/share/logstash/logstash-core/lib/logstash/output_delegator.rb:49:inmulti_receive'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:434:in output_batch'", "org/jruby/RubyHash.java:1342:ineach'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:433:in output_batch'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:381:inworker_loop'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:342:in `start_workers'"]}

Kindly suggest the solution.

see Remove header information added by logstash

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.