Hello Experts,
We facing an issue, while sending syslog event output from TCP, some times TCP hangs and then outputs the syslog event. The major problem here is that if any event comes in between for output, because TCP output is hanged, the event drops or not sent.
This behavior is happens some times more frequently
Below is the config file used
input {
syslog {
port => 1468
}
udp {
port => 514
type => syslog
}
}
output {
tcp{
host => "10.140.190.105"
port => 1468
codec => line {
format => "%{message}"
}
}
}
Please also find below the logs generated while TCP hangs
[2017-11-24T08:10:34,608][WARN ][logstash.outputs.tcp ] tcp output exception {:host=>"10.140.190.105", :port=>1468, :exception=>#<EOFError: End of file reached>, :backtrace=>["org/jruby/RubyIO.java:3030:in sysread'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-tcp-4.0.2/lib/logstash/outputs/tcp.rb:162:inregister'", "org/jruby/RubyProc.java:281:in call'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-codec-line-3.0.4/lib/logstash/codecs/line.rb:54:inencode'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-tcp-4.0.2/lib/logstash/outputs/tcp.rb:207:in receive'", "/usr/share/logstash/logstash-core/lib/logstash/outputs/base.rb:92:inmulti_receive'", "org/jruby/RubyArray.java:1613:in each'", "/usr/share/logstash/logstash-core/lib/logstash/outputs/base.rb:92:inmulti_receive'", "/usr/share/logstash/logstash-core/lib/logstash/output_delegator_strategies/single.rb:15:in multi_receive'", "org/jruby/ext/thread/Mutex.java:149:insynchronize'", "/usr/share/logstash/logstash-core/lib/logstash/output_delegator_strategies/single.rb:14:in multi_receive'", "/usr/share/logstash/logstash-core/lib/logstash/output_delegator.rb:49:inmulti_receive'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:434:in output_batch'", "org/jruby/RubyHash.java:1342:ineach'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:433:in output_batch'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:381:inworker_loop'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:342:in `start_workers'"]}
Kindly suggest the solution.