# Elasticsearch keepalive idle timer for logstash connections via http

**URL:** <https://discuss.elastic.co/t/elasticsearch-keepalive-idle-timer-for-logstash-connections-via-http/252981>\
**Category:** Elasticsearch\
**Created:** [October 22, 2020, 10:11am UTC](https://discuss.elastic.co/t/elasticsearch-keepalive-idle-timer-for-logstash-connections-via-http/252981 "2020-10-22T10:11:33Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![reykime](https://avatars.discourse-cdn.com/v4/letter/r/74df32/32.png) [@reykime](https://discuss.elastic.co/u/reykime)\
**Post date:** [October 22, 2020, 10:11am UTC](https://discuss.elastic.co/t/elasticsearch-keepalive-idle-timer-for-logstash-connections-via-http/252981/1 "2020-10-22T10:11:33Z")

</div>

Hey Guys

I'm currently running into an issue where i see the following messages in logstash:

`Marking url as dead. Last error: [LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError] Elasticsearch Unreachable: [https://logstash_writer:xxxxxx@xxx:9200/][Manticore::SocketTimeout] Read timed out {:url=>https://logstash_writer:xxxxxx@xxx:9200/, :error_message=>"Elasticsearch Unreachable: [https://logstash_writer:xxxxxx@xxx:9200/][Manticore::SocketTimeout] Read timed out", :error_class=>"LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError"}`

I've figured out that those messages are caused by an idle timeout on our firewall which is set to 1 hour. If found the following settings in the documentation:

[https://www.elastic.co/guide/en/elasticsearch/reference/7.10/modules-http.html](https://www.elastic.co/guide/en/elasticsearch/reference/7.10/modules-http.html)  
`http.tcp.keep_idle: Defaults to network.tcp.keep_idle , which uses the system default. This value cannot exceed 300 seconds. ` (Couldn't find it in the 7.8 reference that our cluster is running)

And I'm not sure if it is the right setting for me (can't just change the setting as it the production cluster) Default on my Linux system is 7200 seconds  
`# cat /proc/sys/net/ipv4/tcp_keepalive_time 7200`

Does this mean that although the default value on my system is `7200`, thath `http.tcp.keep_idle` will be only `300`?

Best regards  
Mike

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 19, 2020, 10:11am UTC](https://discuss.elastic.co/t/elasticsearch-keepalive-idle-timer-for-logstash-connections-via-http/252981/2 "2020-11-19T10:11:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.