We updated to version 1.4.2 of logstash, using the official rpm package from the elasticsearch repository. After this update, we realized, the nagios_nsca plugin stopped working (stopped to output events to out icinga).
After manualy updating lib/logstash/outputs/nagios_nsca.rb to commit 65af91d0158725fd18dc09897c6d73839efa47d0 and some debugging we found the following solution:
Open3.popen3(*cmd) do |i, o, e|
Open3.popen3(*cmd) do |i, o, e, t|
To us the problem seamed to be a timing problem because logstash is not waiting for the termination of the process.