ERR Failed to publish events caused by: write tcp - wsasend: An existing connection was forcibly closed by the remote host

good afternoon! logstash version is 5.6.2, filebeat for windows version is 5.1.1, i have a problem with one of our filebeat agents and see in filebeat log file this:
ERR Failed to publish events caused by: write tcp - wsasend: An existing connection was forcibly closed by the remote host

which side is problem i can't understand, other filebeat agents at another servers works fine with same config, all the firewalls setup correctly. Please help!