Hi everyone, I'm sending some network logs from RSA Netwitness SIEM to a logstash server over TCP on port 5515. Currently logstash is not able to separate the incoming data into separate records, its considering the entire stream as a single record. When I tried to listen on same port with Rsyslo…

Badger February 11, 2020, 9:10pm 2

A tcp input creates one event for each line of text. If your messages do not contain a newline it will not flush them until it is stopped.

Data Dropped by Logstash

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Unable to split message received on TCP port into individual records