# TCP syslog output not working properly in logstash

**URL:** https://discuss.elastic.co/t/tcp-syslog-output-not-working-properly-in-logstash/108830
**Category:** Logstash
**Created:** [November 23, 2017, 7:53am UTC](https://discuss.elastic.co/t/tcp-syslog-output-not-working-properly-in-logstash/108830 "2017-11-23T07:53:27Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![vishal0708gautam](https://avatars.discourse-cdn.com/v4/letter/v/ee59a6/32.png) [@vishal0708gautam](https://discuss.elastic.co/u/vishal0708gautam)
#### Post date: [November 23, 2017, 7:53am UTC](https://discuss.elastic.co/t/tcp-syslog-output-not-working-properly-in-logstash/108830/1 "2017-11-23T07:53:27Z")

</div>

We are using logstash for UDP & TCP syslog events receiving and forwarding. The input for TCP & UDP in logstash is working properly and receiving all the syslog events but TCP output syslog forwarding its not working properly, while forwarding syslog events to output it drops the event & hangs until next syslog event is sent. (This problem is random does not happens with each syslog event).

## Below is the logstash.conf

input {

syslog {  
port =\> 1468  
}  
udp {  
port =\> 514  
type =\> syslog  
}  
}

output {

## syslog{ host =\> "10.140.190.105" port =\> 1468 protocol =\> tcp } }

and below is the log TCP throws whenever it it drop an syslog events on just arrival of next syslog event.

[2017-11-23T07:30:46,801][WARN][logstash.licensechecker.xpackinfo] Nil response from License Server  
2017-11-23T07:30:51.021Z 10.140.190.105 \<13\>Nov 23 07:30:51 127.0.0.11  
[2017-11-23T07:30:58,845][WARN][logstash.outputs.syslog] syslog tcp output exception: closing, reconnecting and resending event {:host=\>"10.140.190.105", :port=\>1468, :exception=\>#\<Errno::EPIPE: Broken pipe - Broken pipe\>, :backtrace=\>["org/jruby/RubyIO.java:1431:in `write'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-syslog-3.0.3/lib/logstash/outputs/syslog.rb:178:in`publish'", "org/jruby/RubyProc.java:281:in `call'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-codec-plain-3.0.4/lib/logstash/codecs/plain.rb:41:in`encode'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-syslog-3.0.3/lib/logstash/outputs/syslog.rb:147:in `receive'", "/usr/share/logstash/logstash-core/lib/logstash/outputs/base.rb:92:in`multi\_receive'", "org/jruby/RubyArray.java:1613:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/outputs/base.rb:92:in`multi\_receive'", "/usr/share/logstash/logstash-core/lib/logstash/output\_delegator\_strategies/legacy.rb:22:in `multi_receive'", "/usr/share/logstash/logstash-core/lib/logstash/output_delegator.rb:49:in`multi\_receive'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:434:in `output_batch'", "org/jruby/RubyHash.java:1342:in`each'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:433:in `output_batch'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:381:in`worker\_loop'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:342:in `start\_workers'"], :event=\>2017-11-23T07:30:58.838Z 10.140.190.105 \<13\>Nov 23 07:30:58 127.0.0.11

Kindly suggest the solution.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 21, 2017, 7:53am UTC](https://discuss.elastic.co/t/tcp-syslog-output-not-working-properly-in-logstash/108830/2 "2017-12-21T07:53:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.