diff --git a/x-pack/filebeat/module/aws/elb/test/elb-tcp.log b/x-pack/filebeat/module/aws/elb/test/elb-tcp.log
new file mode 100644
index 00000000000..2ef0527debf
--- /dev/null
+++ b/x-pack/filebeat/module/aws/elb/test/elb-tcp.log
@@ -0,0 +1,6 @@
+2019-10-17T13:22:51.758784Z filebeat-aws-elb-test-elb 77.227.156.41:51600 10.0.0.47:80 0.000943 0.00001 0.000015 - - 134 859 "- - - " "-" - -
+2019-10-17T13:23:07.523763Z filebeat-aws-elb-test-elb 77.227.156.41:51726 10.0.1.184:80 0.000501 0.00001 0.000015 - - 134 859 "- - - " "-" - -
+2019-10-17T13:23:08.477627Z filebeat-aws-elb-test-elb 77.227.156.41:51734 10.0.0.47:80 0.001105 0.00001 0.000015 - - 134 859 "- - - " "-" - -
+2019-10-17T13:23:09.174797Z filebeat-aws-elb-test-elb 77.227.156.41:51738 10.0.1.184:80 0.000422 0.000009 0.000013 - - 134 859 "- - - " "-" - -
+2019-10-17T13:26:14.308385Z filebeat-aws-elb-test-elb 77.227.156.41:46288 10.0.0.47:80 0.000534 0.000011 0.000016 - - 7 343 "- - - " "-" - -
+2019-10-17T13:26:19.318250Z filebeat-aws-elb-test-elb 77.227.156.41:46304 10.0.1.184:80 0.001004 0.00001 0.000015 - - 17 343 "- - - " "-" - -
diff --git a/x-pack/filebeat/module/aws/elb/test/elb-tcp.log-expected.json b/x-pack/filebeat/module/aws/elb/test/elb-tcp.log-expected.json
new file mode 100644
index 00000000000..8f92ac96d31
--- /dev/null
+++ b/x-pack/filebeat/module/aws/elb/test/elb-tcp.log-expected.json
@@ -0,0 +1,182 @@
+[
+    {
+        "@timestamp": "2019-10-17T13:22:51.758Z",
+        "aws.elb.backend.ip": "10.0.0.47",
+        "aws.elb.backend.port": "80",
+        "aws.elb.backend_processing_time.sec": 1e-05,
+        "aws.elb.name": "filebeat-aws-elb-test-elb",
+        "aws.elb.protocol": "tcp",
+        "aws.elb.request_processing_time.sec": 0.000943,
+        "aws.elb.response_processing_time.sec": 1.5e-05,
+        "destination.bytes": 859,
+        "event.dataset": "aws.elb",
+        "event.end": "2019-10-17T13:22:51.758Z",
+        "event.module": "aws",
+        "fileset.name": "elb",
+        "input.type": "log",
+        "log.offset": 0,
+        "service.type": "aws",
+        "source.as.number": 12430,
+        "source.as.organization.name": "Vodafone Spain",
+        "source.bytes": 134,
+        "source.geo.city_name": "Sant Cugat del Vall\u00e8s",
+        "source.geo.continent_name": "Europe",
+        "source.geo.country_iso_code": "ES",
+        "source.geo.location.lat": 41.4667,
+        "source.geo.location.lon": 2.0833,
+        "source.geo.region_iso_code": "ES-B",
+        "source.geo.region_name": "Barcelona",
+        "source.ip": "77.227.156.41",
+        "source.port": "51600"
+    },
+    {
+        "@timestamp": "2019-10-17T13:23:07.523Z",
+        "aws.elb.backend.ip": "10.0.1.184",
+        "aws.elb.backend.port": "80",
+        "aws.elb.backend_processing_time.sec": 1e-05,
+        "aws.elb.name": "filebeat-aws-elb-test-elb",
+        "aws.elb.protocol": "tcp",
+        "aws.elb.request_processing_time.sec": 0.000501,
+        "aws.elb.response_processing_time.sec": 1.5e-05,
+        "destination.bytes": 859,
+        "event.dataset": "aws.elb",
+        "event.end": "2019-10-17T13:23:07.523Z",
+        "event.module": "aws",
+        "fileset.name": "elb",
+        "input.type": "log",
+        "log.offset": 142,
+        "service.type": "aws",
+        "source.as.number": 12430,
+        "source.as.organization.name": "Vodafone Spain",
+        "source.bytes": 134,
+        "source.geo.city_name": "Sant Cugat del Vall\u00e8s",
+        "source.geo.continent_name": "Europe",
+        "source.geo.country_iso_code": "ES",
+        "source.geo.location.lat": 41.4667,
+        "source.geo.location.lon": 2.0833,
+        "source.geo.region_iso_code": "ES-B",
+        "source.geo.region_name": "Barcelona",
+        "source.ip": "77.227.156.41",
+        "source.port": "51726"
+    },
+    {
+        "@timestamp": "2019-10-17T13:23:08.477Z",
+        "aws.elb.backend.ip": "10.0.0.47",
+        "aws.elb.backend.port": "80",
+        "aws.elb.backend_processing_time.sec": 1e-05,
+        "aws.elb.name": "filebeat-aws-elb-test-elb",
+        "aws.elb.protocol": "tcp",
+        "aws.elb.request_processing_time.sec": 0.001105,
+        "aws.elb.response_processing_time.sec": 1.5e-05,
+        "destination.bytes": 859,
+        "event.dataset": "aws.elb",
+        "event.end": "2019-10-17T13:23:08.477Z",
+        "event.module": "aws",
+        "fileset.name": "elb",
+        "input.type": "log",
+        "log.offset": 285,
+        "service.type": "aws",
+        "source.as.number": 12430,
+        "source.as.organization.name": "Vodafone Spain",
+        "source.bytes": 134,
+        "source.geo.city_name": "Sant Cugat del Vall\u00e8s",
+        "source.geo.continent_name": "Europe",
+        "source.geo.country_iso_code": "ES",
+        "source.geo.location.lat": 41.4667,
+        "source.geo.location.lon": 2.0833,
+        "source.geo.region_iso_code": "ES-B",
+        "source.geo.region_name": "Barcelona",
+        "source.ip": "77.227.156.41",
+        "source.port": "51734"
+    },
+    {
+        "@timestamp": "2019-10-17T13:23:09.174Z",
+        "aws.elb.backend.ip": "10.0.1.184",
+        "aws.elb.backend.port": "80",
+        "aws.elb.backend_processing_time.sec": 9e-06,
+        "aws.elb.name": "filebeat-aws-elb-test-elb",
+        "aws.elb.protocol": "tcp",
+        "aws.elb.request_processing_time.sec": 0.000422,
+        "aws.elb.response_processing_time.sec": 1.3e-05,
+        "destination.bytes": 859,
+        "event.dataset": "aws.elb",
+        "event.end": "2019-10-17T13:23:09.174Z",
+        "event.module": "aws",
+        "fileset.name": "elb",
+        "input.type": "log",
+        "log.offset": 427,
+        "service.type": "aws",
+        "source.as.number": 12430,
+        "source.as.organization.name": "Vodafone Spain",
+        "source.bytes": 134,
+        "source.geo.city_name": "Sant Cugat del Vall\u00e8s",
+        "source.geo.continent_name": "Europe",
+        "source.geo.country_iso_code": "ES",
+        "source.geo.location.lat": 41.4667,
+        "source.geo.location.lon": 2.0833,
+        "source.geo.region_iso_code": "ES-B",
+        "source.geo.region_name": "Barcelona",
+        "source.ip": "77.227.156.41",
+        "source.port": "51738"
+    },
+    {
+        "@timestamp": "2019-10-17T13:26:14.308Z",
+        "aws.elb.backend.ip": "10.0.0.47",
+        "aws.elb.backend.port": "80",
+        "aws.elb.backend_processing_time.sec": 1.1e-05,
+        "aws.elb.name": "filebeat-aws-elb-test-elb",
+        "aws.elb.protocol": "tcp",
+        "aws.elb.request_processing_time.sec": 0.000534,
+        "aws.elb.response_processing_time.sec": 1.6e-05,
+        "destination.bytes": 343,
+        "event.dataset": "aws.elb",
+        "event.end": "2019-10-17T13:26:14.308Z",
+        "event.module": "aws",
+        "fileset.name": "elb",
+        "input.type": "log",
+        "log.offset": 571,
+        "service.type": "aws",
+        "source.as.number": 12430,
+        "source.as.organization.name": "Vodafone Spain",
+        "source.bytes": 7,
+        "source.geo.city_name": "Sant Cugat del Vall\u00e8s",
+        "source.geo.continent_name": "Europe",
+        "source.geo.country_iso_code": "ES",
+        "source.geo.location.lat": 41.4667,
+        "source.geo.location.lon": 2.0833,
+        "source.geo.region_iso_code": "ES-B",
+        "source.geo.region_name": "Barcelona",
+        "source.ip": "77.227.156.41",
+        "source.port": "46288"
+    },
+    {
+        "@timestamp": "2019-10-17T13:26:19.318Z",
+        "aws.elb.backend.ip": "10.0.1.184",
+        "aws.elb.backend.port": "80",
+        "aws.elb.backend_processing_time.sec": 1e-05,
+        "aws.elb.name": "filebeat-aws-elb-test-elb",
+        "aws.elb.protocol": "tcp",
+        "aws.elb.request_processing_time.sec": 0.001004,
+        "aws.elb.response_processing_time.sec": 1.5e-05,
+        "destination.bytes": 343,
+        "event.dataset": "aws.elb",
+        "event.end": "2019-10-17T13:26:19.318Z",
+        "event.module": "aws",
+        "fileset.name": "elb",
+        "input.type": "log",
+        "log.offset": 712,
+        "service.type": "aws",
+        "source.as.number": 12430,
+        "source.as.organization.name": "Vodafone Spain",
+        "source.bytes": 17,
+        "source.geo.city_name": "Sant Cugat del Vall\u00e8s",
+        "source.geo.continent_name": "Europe",
+        "source.geo.country_iso_code": "ES",
+        "source.geo.location.lat": 41.4667,
+        "source.geo.location.lon": 2.0833,
+        "source.geo.region_iso_code": "ES-B",
+        "source.geo.region_name": "Barcelona",
+        "source.ip": "77.227.156.41",
+        "source.port": "46304"
+    }
+]