Logstash syslog input shoud use UDP instead of TCP

[joerg]

By default syslog should always use UDP instead of TCP. With TCP the problem is, that if the syslog (logstash) server is unavailable the sending server will start blocking of caching which can be very problematic. This can even crash your whole infrastructure if the logstash server is down for too long.

[patcon]

+1

was just investigating why tcp type instead of logstash:
http://logstash.net/docs/1.3.2/inputs/syslog

[martinb3]

There's definitely some different tolerance for loss of logs across implementations... some people seem to want to never lose logs and bring down the service before they lose logs, and some want to drop logs and always keep the service up.

We defaulted to the one that doesn't lose logs, but perhaps we should provide an option?

[patcon]

Ah, that makes sense. syslog input starts listeners for udp and tcp fwiw

[martinb3]

Indeed 👍