ERR - Failed to publish events caused by: EOF

Elastic Stack Beats
1

filebeat 5.0.

Filebeat stop sending logs and i get these errors. Restart doesnt work and same errors again. The only solution is to remove registry file and start again.

2016-11-09T20:52:21+01:00 INFO Non-zero metrics in the last 30s: registrar.writes=5
libbeat.logstash.call_count.PublishEvents=9 libbeat.logstash.publish.read_errors=4 libbeat.logstash.publish.write_bytes=30363 publish.events=210 libbeat.logstash.published_but_not_acked_events=150 registrar.states.update=210 libbeat.logstash.publish.read_bytes=96 libbeat.logstash.published_and_acked_events=210 libbeat.publisher.published_events=210
2016-11-09T20:52:26+01:00 ERR Failed to publish events caused by: EOF
2016-11-09T20:52:26+01:00 INFO Error publishing events (retrying): EOF
2016-11-09T20:52:31+01:00 ERR Failed to publish events caused by: EOF
2016-11-09T20:52:31+01:00 INFO Error publishing events (retrying): EOF
2016-11-09T20:52:41+01:00 ERR Failed to publish events caused by: EOF
2016-11-09T20:52:41+01:00 INFO Error publishing events (retrying): EOF
2016-11-09T20:52:51+01:00 INFO Non-zero metrics in the last 30s: libbeat.logstash.publish.write_bytes=20902 registrar.states.update=155 libbeat.publisher.published_events=155 publish.events=155 libbeat.logstash.publish.read_errors=3 libbeat.logstash.call_count.PublishEvents=8 libbeat.logstash.publish.read_bytes=78 libbeat.logstash.published_and_acked_events=155 libbeat.logstash.published_but_not_acked_events=84 registrar.writes=5
2016-11-09T20:52:51+01:00 ERR Failed to publish events caused by: EOF
2016-11-09T20:52:51+01:00 INFO Error publishing events (retrying): EOF
2016-11-09T20:52:56+01:00 ERR Failed to publish events caused by: EOF
2016-11-09T20:52:56+01:00 INFO Error publishing events (retrying): EOF
2016-11-09T20:53:06+01:00 ERR Failed to publish events caused by: EOF
2016-11-09T20:53:06+01:00 INFO Error publishing events (retrying): EOF

2

So when you remove the registry file, further events are sent and you don't see the EOF anymore? That is kind of strange as registry is not related to the output and this seems to be an output issue. I'm curious if it could be related to a specific event which cannot be handled? Be aware that in the above logs some of the messages are still sent and acked, just not all. Do you seen any errors on the LS side in the logs?

3

No, I didnt see any error in LS. Since I removed registry file i havent seen these errors. I will let you know if the come up again.

4

EOF in logstash output means, connection has been closed. You can try running logstash in debug mode, in case connection is closed by logstash.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.