# ERR Failed to publish events caused by: read tcp 127.0.0.1:50248-\>127.0.0.1:5601: i/o timeout **URL:** \ **Category:** Beats\ **Tags:** winlogbeat\ **Created:** [September 26, 2017, 9:39am UTC](https://discuss.elastic.co/t/err-failed-to-publish-events-caused-by-read-tcp-127-0-0-1-50248-127-0-0-1-5601-i-o-timeout/101813 "2017-09-26T09:39:10Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![daffe0x77](https://avatars.discourse-cdn.com/v4/letter/d/db5fbb/32.png) [@daffe0x77](https://discuss.elastic.co/u/daffe0x77)\ **Post date:** [September 26, 2017, 9:39am UTC](https://discuss.elastic.co/t/err-failed-to-publish-events-caused-by-read-tcp-127-0-0-1-50248-127-0-0-1-5601-i-o-timeout/101813/1 "2017-09-26T09:39:10Z")
To visualize Windows Event Logs I've setup an ELK server running all 3 components on the same box. Think for testing and learning ELK should be doable. Logs forwarded are account lockouts (Event ID 4740) from Domain Controllers. I was able to pull in and visualize some of these forwarded logs but all of a sudden it stoped. I also noticed the Logstash service restarted automatically on a short but regular interval. Re-installing the Logstash service fixed this and it is now in a permanent running state. But not log information appears to be shipped. Looking at the winlogbeat log files the error from the subject of this request for help is shown: _ERR Failed to publish events caused by: read tcp 127.0.0.1:50248-\>127.0.0.1:5601: i/o timeout_ When I enable the debug option for winlogbeat is see the forwarded events it is picking up from the Forwarded Events log on the same server. Any help or ideas are welcome to solve the error shown I already read many posts here but none appear to fix my issue. Platform is Windows Server 2016, 8GB RAM, 2 CPU's Latest ELK downloads. Telnet to port 5601 is fine, although slow in response. Java Platform SE binary takes all the CPU. > winlogbeat.yml > ![winlogbeat](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1abbdf45dd13360fcf2927e77b2ae7075b0a224a.png) > logstash config.json > ![json](https://us1.discourse-cdn.com/elastic/original/3X/c/8/c81b7b732f1c51b3c4aa077c087554f359a1a36a.png) ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [September 26, 2017, 9:46am UTC](https://discuss.elastic.co/t/err-failed-to-publish-events-caused-by-read-tcp-127-0-0-1-50248-127-0-0-1-5601-i-o-timeout/101813/2 "2017-09-26T09:46:24Z")
Port 5601 is usually used by Kibana, but you have configured the beats inout in Logstash to use it, which may be causing the problem. I would recommend using a different port for the Logstas beats input and update Winlogbeat to use tis. ---
**Author:** ![daffe0x77](https://avatars.discourse-cdn.com/v4/letter/d/db5fbb/32.png) [@daffe0x77](https://discuss.elastic.co/u/daffe0x77)\ **Post date:** [September 26, 2017, 9:47am UTC](https://discuss.elastic.co/t/err-failed-to-publish-events-caused-by-read-tcp-127-0-0-1-50248-127-0-0-1-5601-i-o-timeout/101813/3 "2017-09-26T09:47:56Z")
Hello Christian Thanks for your reply, how to change the port for logstash? ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [September 26, 2017, 9:52am UTC](https://discuss.elastic.co/t/err-failed-to-publish-events-caused-by-read-tcp-127-0-0-1-50248-127-0-0-1-5601-i-o-timeout/101813/4 "2017-09-26T09:52:40Z")
Change in the Logstash config. ---
**Author:** ![daffe0x77](https://avatars.discourse-cdn.com/v4/letter/d/db5fbb/32.png) [@daffe0x77](https://discuss.elastic.co/u/daffe0x77)\ **Post date:** [September 26, 2017, 9:56am UTC](https://discuss.elastic.co/t/err-failed-to-publish-events-caused-by-read-tcp-127-0-0-1-50248-127-0-0-1-5601-i-o-timeout/101813/5 "2017-09-26T09:56:30Z")
Changed the port: _ERR Connecting error publishing events (retrying): dial tcp 127.0.0.1:5000: connectex: No connection could be made because the target machine actively refused it._ ---
**Author:** ![daffe0x77](https://avatars.discourse-cdn.com/v4/letter/d/db5fbb/32.png) [@daffe0x77](https://discuss.elastic.co/u/daffe0x77)\ **Post date:** [September 26, 2017, 12:31pm UTC](https://discuss.elastic.co/t/err-failed-to-publish-events-caused-by-read-tcp-127-0-0-1-50248-127-0-0-1-5601-i-o-timeout/101813/6 "2017-09-26T12:31:39Z")
Ok I changed the port to 9300 assuming that is the correct one to use. Yet another error showed. _ERR Failed to publish events caused by: EOF_ ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [September 26, 2017, 12:36pm UTC](https://discuss.elastic.co/t/err-failed-to-publish-events-caused-by-read-tcp-127-0-0-1-50248-127-0-0-1-5601-i-o-timeout/101813/7 "2017-09-26T12:36:47Z")
You should not use the 9300 port. Winlogbeat should connect to Logstash on port 5000 (update winlogbeat.yml). The beats input should listen to port 5000 and the Elasticsearch output should connect to Elasticsearch on port 9200 (both updated in config.json). Please share your configuration files again once you have updated them. ---
**Author:** ![daffe0x77](https://avatars.discourse-cdn.com/v4/letter/d/db5fbb/32.png) [@daffe0x77](https://discuss.elastic.co/u/daffe0x77)\ **Post date:** [September 26, 2017, 12:42pm UTC](https://discuss.elastic.co/t/err-failed-to-publish-events-caused-by-read-tcp-127-0-0-1-50248-127-0-0-1-5601-i-o-timeout/101813/8 "2017-09-26T12:42:07Z")
Logstash config file ![json](https://us1.discourse-cdn.com/elastic/original/3X/d/d/ddf06afbc0789545367bb06ebc3d60d90349faf2.png) Winlogbeat ![winlogbeat](https://us1.discourse-cdn.com/elastic/original/3X/b/e/be1ad64f6f51a42902edad7c2da6b17959798e67.png) ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [September 26, 2017, 12:43pm UTC](https://discuss.elastic.co/t/err-failed-to-publish-events-caused-by-read-tcp-127-0-0-1-50248-127-0-0-1-5601-i-o-timeout/101813/9 "2017-09-26T12:43:28Z")
Yes, that looks fine as far as I can see. ---
**Author:** ![daffe0x77](https://avatars.discourse-cdn.com/v4/letter/d/db5fbb/32.png) [@daffe0x77](https://discuss.elastic.co/u/daffe0x77)\ **Post date:** [September 26, 2017, 12:45pm UTC](https://discuss.elastic.co/t/err-failed-to-publish-events-caused-by-read-tcp-127-0-0-1-50248-127-0-0-1-5601-i-o-timeout/101813/10 "2017-09-26T12:45:44Z")
_2017-09-26T05:45:03-07:00 INFO Home path: [D:\Program Files\winlogbeat-5.6.0-windows-x86\_64] Config path: [D:\Program Files\winlogbeat-5.6.0-windows-x86\_64] Data path: [C:\ProgramData\winlogbeat] Logs path: [D:\Program Files\winlogbeat-5.6.0-windows-x86\_64\logs]_ _2017-09-26T05:45:03-07:00 INFO Setup Beat: winlogbeat; Version: 5.6.0_ _2017-09-26T05:45:03-07:00 INFO Max Retries set to: 3_ _2017-09-26T05:45:03-07:00 INFO Activated logstash as output plugin._ _2017-09-26T05:45:03-07:00 INFO Publisher name: gdcpwsec01_ _2017-09-26T05:45:04-07:00 INFO Metrics logging every 30s_ _2017-09-26T05:45:04-07:00 INFO Flush Interval set to: 1s_ _2017-09-26T05:45:04-07:00 INFO Max Bulk Size set to: 2048_ _2017-09-26T05:45:04-07:00 INFO State will be read from and persisted to C:\ProgramData\winlogbeat.winlogbeat.yml_ _2017-09-26T05:45:04-07:00 INFO winlogbeat start running._ _2017-09-26T05:45:06-07:00 ERR Connecting error publishing events (retrying): dial tcp 127.0.0.1:5000: connectex: No connection could be made because the target machine actively refused it._ _2017-09-26T05:45:10-07:00 ERR Connecting error publishing events (retrying): dial tcp 127.0.0.1:5000: connectex: No connection could be made because the target machine actively refused it._ ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [September 26, 2017, 12:48pm UTC](https://discuss.elastic.co/t/err-failed-to-publish-events-caused-by-read-tcp-127-0-0-1-50248-127-0-0-1-5601-i-o-timeout/101813/11 "2017-09-26T12:48:03Z")
Have all components started up OK? Can you connect to the ports using telnet? ---
**Author:** ![daffe0x77](https://avatars.discourse-cdn.com/v4/letter/d/db5fbb/32.png) [@daffe0x77](https://discuss.elastic.co/u/daffe0x77)\ **Post date:** [September 26, 2017, 12:51pm UTC](https://discuss.elastic.co/t/err-failed-to-publish-events-caused-by-read-tcp-127-0-0-1-50248-127-0-0-1-5601-i-o-timeout/101813/12 "2017-09-26T12:51:34Z")
Yes services started properly. But can't connect on port 5000 using telnet. _Microsoft Telnet\> o ( to ) 127.0.0.1 5000 Connecting To 127.0.0.1...Could not open connection to the host, on port 5000: Connect failed Microsoft Telnet\>_ ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [September 26, 2017, 1:16pm UTC](https://discuss.elastic.co/t/err-failed-to-publish-events-caused-by-read-tcp-127-0-0-1-50248-127-0-0-1-5601-i-o-timeout/101813/13 "2017-09-26T13:16:41Z")
That probably means that Logstash have not started ups correctly. Can you see anything in the Logstash logs? ---
**Author:** ![daffe0x77](https://avatars.discourse-cdn.com/v4/letter/d/db5fbb/32.png) [@daffe0x77](https://discuss.elastic.co/u/daffe0x77)\ **Post date:** [September 26, 2017, 2:04pm UTC](https://discuss.elastic.co/t/err-failed-to-publish-events-caused-by-read-tcp-127-0-0-1-50248-127-0-0-1-5601-i-o-timeout/101813/14 "2017-09-26T14:04:19Z")
Found it. I had Logstash installed in "Program Files\Logstash", changed to a folder with no " " and now it runs. I wonder why it had worked before. Mayb during my first try is was ingesting directly in ES. Anyway thanks for your help Christion. Really appreciate it. Regards. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 24, 2017, 2:04pm UTC](https://discuss.elastic.co/t/err-failed-to-publish-events-caused-by-read-tcp-127-0-0-1-50248-127-0-0-1-5601-i-o-timeout/101813/15 "2017-10-24T14:04:20Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.