# TLS handshake failure between Logstash-LB and log drops in Logstash server

**URL:** <https://discuss.elastic.co/t/tls-handshake-failure-between-logstash-lb-and-log-drops-in-logstash-server/383469>\
**Category:** Logstash\
**Created:** [November 16, 2025, 5:24pm UTC](https://discuss.elastic.co/t/tls-handshake-failure-between-logstash-lb-and-log-drops-in-logstash-server/383469 "2025-11-16T17:24:26Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Subhanwita\_Mullick](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/subhanwita_mullick/32/108874_2.png) [@Subhanwita\_Mullick](https://discuss.elastic.co/u/Subhanwita_Mullick)\
**Post date:** [November 16, 2025, 5:24pm UTC](https://discuss.elastic.co/t/tls-handshake-failure-between-logstash-lb-and-log-drops-in-logstash-server/383469/1 "2025-11-16T17:24:26Z")

</div>

My architecture is Sources –\> Load balancer –\> Logstash server (8 CPU, 16 GB) –\> Azure Sentinel.

For the store logs, we just did an extensive traffic analysis as well. In the connectivity between LB and Logstash cluster (2 servers) we identified that the TLS handshake is failing on port TCP 6514. Due to this event, connection draining is happening and less and less stores will be able to push syslog data. We could see that a TCP handshake is fine. But once the TLS Handshake start, we noticed a client-hello is being sent by the LB and acknowledged by the Logstash server. From this moment the communication stops.

Please find below the all the checks and findings from Logstash end:

1. Verify that Logstash is listening on TCP/6514 with TLS enabled:

tcp 0 0 141.93.182.143:6514 0.0.0.0:\* LISTEN 1052/java

1. Logstash input configuration verify: There is no change till today in this input file.

2. Verify Certificate validity: Checked fine

3. Intermediate CA verification: OK

4. File descriptor changed to 65535

5. Nothing in Logstash plain logs. SSL Debug log was enabled for last one day, but no single error/exception is observed till now related to TLS negotiations. No connection reset error observed also.

6. Tested TLS handshake locally, run directly in Logstash server, but it got hang after connected:

7. As per tcp dump analysis, it takes 107 seconds to send the sever-hello message, so this makes sense we don't see the server-hello on client side. but even though this flow has 146 seconds before it sends the server-hello to the client, but the clients allows it and a session seems to be established. but 100+ seconds for a server-hello = not done.

Please help to resolve this issue.