ERR Failed to publish events caused by: write tcp - Filebeat

[Nikhilpawar1985 (Nikhil Pawar)]

Hey guys ,

Can someone please please help me resolve this . I am new to this trying to implement it prod environment ASAP .

017-06-19T14:16:10-04:00 ERR Failed to publish events caused by: write tcp 10.140.76.11:35266->10.140.223.89:5044: write: connection reset by peer
2017-06-19T14:16:10-04:00 INFO Error publishing events (retrying): write tcp 10.140.76.11:35266->10.140.223.89:5044: write: connection reset by peer
2017-06-19T14:16:10-04:00 INFO Non-zero metrics in the last 30s: libbeat.logstash.call_count.PublishEvents=1 libbeat.logstash.publish.write_errors=1 libbeat.logstash.published_but_not_acked_events=2 libbeat.publisher.published_events=2
2017-06-19T14:16:40-04:00 INFO Non-zero metrics in the last 30s: libbeat.logstash.call_count.PublishEvents=1 libbeat.logstash.publish.read_bytes=6 libbeat.logstash.publish.write_bytes=410 libbeat.logstash.published_and_acked_events=2 publish.events=2 registrar.states.update=2 registrar.writes=1
2017-06-19T14:17:10-04:00 INFO Non-zero metrics in the last 30s: libbeat.logstash.call_count.PublishEvents=1 libbeat.logstash.publish.read_bytes=6 libbeat.logstash.publish.write_bytes=421 libbeat.logstash.published_and_acked_events=2 libbeat.publisher.published_events=2 publish.events=2 registrar.states.update=2 registrar.writes=1
2017-06-19T14:17:40-04:00 INFO Non-zero metrics in the last 30s: libbeat.logstash.call_count.PublishEvents=1 libbeat.logstash.publish.read_bytes=6 libbeat.logstash.publish.write_bytes=396 libbeat.logstash.published_and_acked_events=4 libbeat.publisher.published_events=4 publish.events=4 registrar.states.update=4 registrar.writes=1
2017-06-19T14:18:10-04:00 INFO Non-zero metrics in the last 30s: libbeat.logstash.call_count.PublishEvents=1 libbeat.logstash.publish.read_bytes=6 libbeat.logstash.publish.write_bytes=411 libbeat.logstash.published_and_acked_events=2 libbeat.publisher.published_events=2 publish.events=2 registrar.states.update=2 registrar.writes=1
2017-06-19T14:18:40-04:00 INFO No non-zero metrics in the last 30s
2017-06-19T14:19:10-04:00 INFO Non-zero metrics in the last 30s: libbeat.logstash.call_count.PublishEvents=1 libbeat.logstash.publish.read_bytes=6 libbeat.logstash.publish.write_bytes=405 libbeat.logstash.published_and_acked_events=2 libbeat.publisher.published_events=2 publish.events=2 registrar.states.update=2 registrar.writes=1
2017-06-19T14:19:40-04:00 INFO Non-zero metrics in the last 30s: libbeat.logstash.call_count.PublishEvents=2 libbeat.logstash.publish.read_bytes=12 libbeat.logstash.publish.write_bytes=1070 libbeat.logstash.published_and_acked_events=12 libbeat.publisher.published_events=12 publish.events=12 registrar.states.update=12 registrar.writes=2
2017-06-19T14:20:10-04:00 INFO Non-zero metrics in the last 30s: libbeat.logstash.call_count.PublishEvents=2 libbeat.logstash.publish.read_bytes=12 libbeat.logstash.publish.write_bytes=1054 libbeat.logstash.published_and_acked_events=10 libbeat.publisher.published_events=10 publish.events=10 registrar.states.update=10 registrar.writes=2
2017-06-19T14:20:40-04:00 INFO No non-zero metrics in the last 30s
2017-06-19T14:21:10-04:00 ERR Failed to publish events caused by: write tcp 10.140.76.11:35456->10.140.223.89:5044: write: connection reset by peer
2017-06-19T14:21:10-04:00 INFO Error publishing events (retrying): write tcp 10.140.76.11:35456->10.140.223.89:5044: write: connection reset by peer

Thanks

[steffens (Steffen Siering)]

please properly format logs and configuration files using the </> button in the toolbar.

Which filebeat version are you using?

Which logstash version are you using?

Can you share filebeat output configuration and logstash input configuration?

The error message indicates that Logstash, the host logstash is running (e.g. firewall) or some other network device did close the connection while filebeat did try to publish events. Filebeat will reconnect in this case and continue sending. Updating Logstash, the logstash-input-beats plugin might help. Also increase the client_connectivity_timeout setting for the beats input plugin in logstash.

[Nikhilpawar1985 (Nikhil Pawar)]

Thanks
lient_connectivity_timeout fixed the issue