Hi everyone, I'm sending some network logs from RSA Netwitness SIEM to a logstash server over TCP on port 5515. Currently logstash is not able to separate the incoming data into separate records, its considering the entire stream as a single record. When I tried to listen on same port with Rsyslo…

Badger February 11, 2020, 9:10pm 2

A tcp input creates one event for each line of text. If your messages do not contain a newline it will not flush them until it is stopped.

Data Dropped by Logstash

Topic		Replies	Views
Data Dropped by Logstash Logstash	1	198	March 27, 2020
Logstash syslog TCP output breaking to parts Logstash	2	557	January 15, 2018
Split json with no seperator Logstash	2	343	February 24, 2020
Errors with event splitting using the input tcp plugin Logstash docker	5	532	March 18, 2022
TCP output not working well Logstash	1	646	July 6, 2017

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Unable to split message received on TCP port into individual records

Related topics