I am sending some source types to a 3rd party via SYSLOG as the output as TCP not UDP. All works fine until we lose contact with their syslog server. Then it breaks all indexing even to my cluster. The queues fill up and basically shuts down inputs.
Works fine using UDP!
Wondering if anyone has came across this issue. He is output of btool.
That’s not an issue, that is by design (although for you that is then still an issue of course). Whenever one of multiple TCP destinations is unreachable, all forwarding is blocked. And as far as I know, that is not configurable.