# Auditbeat Connection reset by peer

**URL:** <https://discuss.elastic.co/t/auditbeat-connection-reset-by-peer/130206>\
**Category:** Beats\
**Tags:** auditbeat\
**Created:** [May 2, 2018, 7:55am UTC](https://discuss.elastic.co/t/auditbeat-connection-reset-by-peer/130206 "2018-05-02T07:55:26Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![giuliano](https://avatars.discourse-cdn.com/v4/letter/g/ec9cab/32.png) [@giuliano](https://discuss.elastic.co/u/giuliano)\
**Post date:** [May 2, 2018, 7:55am UTC](https://discuss.elastic.co/t/auditbeat-connection-reset-by-peer/130206/1 "2018-05-02T07:55:26Z")

</div>

Hi all,  
I use ELK 6.2.3 version with beat plugin 5.0.10.  
I'm trying to setup the auditbeat 6.2.4 on remote Linux Machine but from the audit log I have these errors:

2018-05-02T09:43:03.884+0200 ERROR logstash/async.go:235 Failed to publish events caused by: write tcp 10.10.20.128:31994-\>10.10.28.140:5004: write: connection reset by peer  
2018-05-02T09:43:04.885+0200 ERROR pipeline/output.go:92 Failed to publish events: write tcp 10.10.20.128:31994-\>10.10.28.140:5004: write: connection reset by peer

a) The Logstash config is:

input  
{  
beats  
{  
port =\> 5004  
}  
}

filter  
{  
mutate  
{  
add\_tag =\> "AUDIT-LNX"  
}  
}

output  
{  
if "audit" in [tags]  
{  
elasticsearch  
{  
hosts =\> "localhost:9200"  
index =\> "audit\_linux\_g2k-%{+YYYY.MM.dd}"  
}  
}

b) The sockets 5004 is running:

root@ELK:/etc/logstash/conf.d# netstat -an | grep 5004  
tcp6 0 0 :::5004 :::\* LISTEN

c) The logstash section in the auditbeat.yml is:

output.logstash:

# Boolean flag to enable or disable the output module.

enabled: true

# The Logstash hosts

hosts: ["10.10.28.140:5004"]

In the past I have had the same problem with filebat 6.2.3, but with "filebeat.publish\_async: true" option I was able to solve this problem....  
I have try to set up a "auditbeat.publish\_async: true" but doesn't change nothing.

Any idea?

Thanking in advance.

Giuliano

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [May 2, 2018, 2:23pm UTC](https://discuss.elastic.co/t/auditbeat-connection-reset-by-peer/130206/2 "2018-05-02T14:23:41Z")

</div>

There's a new version of the logsatsh beats input plugin available. Can you please try [updating to the latest version](https://www.elastic.co/guide/en/beats/libbeat/current/logstash-installation.html#logstash-input-update). Here's the [changelog](https://github.com/logstash-plugins/logstash-input-beats/blob/master/CHANGELOG.md).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 4, 2022, 5:21am UTC](https://discuss.elastic.co/t/auditbeat-connection-reset-by-peer/130206/3 "2022-11-04T05:21:50Z")

</div>