ERR Failed to publish events caused by: read tcp 172.16.1.2:46410->172.16.0.254:5044: i/o timeout

@mksavic There was a lot of issues that were fixed in the logstash beats input related to connection management; I think we should try to update the beats input plugin first and see if it fix your problem.

You can update the plugin using the following command:

bin/logstash-plugin update logstash-input-beats

Also, I think you should look at Logstash 6.3; there was a log of performance improvements that were done between 6.0 and 6.3.