Experimental Physics and
Industrial Control System

I simplly followed the instruction written by Andrew Johnson https://events01.synchrotron.org.au/event/85/contributions/2601/attachments/689/997/5_06_Logstash_for_IOCs.pdf
A thread named "IOClog" in May 2th 2019 had mentioned this.
I've installed logstash 7.2 in a linux box. I configured 'caPutLogInit "10.1.236.30:7011", 1' in st.cmd. The configuration file for logstash is fellowing:
input {
 tcp {
 host => "${EPICS_IOC_LOG_INET:10.1.236.30}"
 port => "${EPICS_IOC_LOG_PORT:7011}"
 codec => "line"
 }
output {
 file {
 path => "/log/ioc/putlog-%{+YYYY-MM-dd}.json"
 }
}
}
That's all the configuration. I can not figure out who closed the connection, but I think logstash may closed it, because iocLogServer will not. I'll try the tcp_keep_alive option next and to see it would work or not.

By the way, I found that the grok filter in the example file is not correct for logstash 7.2

-- 
Complexity comes for free, Simplicity you have to work for.