I have a stack of nxlog -> om_ssl -> tcp input ->logstash. And after i do kill -9 i lose a bunch of messages. i looked up buffered data in logstash and switch it to 1. tested it and if i read file i can lose about max 5 messages. So i tried to look up in nxlog, data_timeout is there 30 sec. so as i looked up with data lose over time it looks it might be it.