ERR Failed to publish events caused by: write tcp

Elastic Stack Logstash
1

Hi,

I am continually getting an error in my file beat. Logs are writing at very very high speed.

filebeat configuration
##########start##############

filebeat:
prospectors:
-
paths:
- /logs/statistics.log
document_type: newlog

- 
  paths:
    - /logs/states.log
  fields_under_root: true
  document_type: txnstatus
  fields:
    json: true
  input_type: log

- 
  paths:
     - /logs/instaproxy.log
  document_type: payment
  input_type: log

- 
  paths:
     - /var/log/secure
  document_type: audit-logs
  input_type: log

registry_file: /var/lib/filebeat/registry
output:
logstash:
hosts: ["10.143.5.41:5044","10.143.5.42:5044","10.143.5.43:5044","10.143.5.44:5044","10.143.5.45:5044","10.143.4.49:5044","10.143.63.47:5044","10.143.63.29:5044","10.143.63.26:5044"]
#hosts: ["10.143.5.41:5045"]
loadbalance: true
worker: 6
shipper:
logging:
files:
path: logs/mybeat
name: mybeat.log
rotateeverybytes: 524288000 # = 50MB

#########END###############

2018-08-09T11:40:12+05:30 ERR Failed to publish events caused by: write tcp 10.143.11.63:34010->10.143.63.47:5044: write: connection reset by peer
2018-08-09T11:40:12+05:30 INFO Error publishing events (retrying): write tcp 10.143.11.63:34010->10.143.63.47:5044: write: connection reset by peer
2018-08-09T11:40:12+05:30 ERR Failed to publish events caused by: write tcp 10.143.11.63:44212->10.143.5.43:5044: write: connection reset by peer
2018-08-09T11:40:12+05:30 INFO Error publishing events (retrying): write tcp 10.143.11.63:44212->10.143.5.43:5044: write: connection reset by peer
2018-08-09T11:40:12+05:30 ERR Failed to publish events caused by: write tcp 10.143.11.63:60216->10.143.5.44:5044: write: connection reset by peer
2018-08-09T11:40:12+05:30 INFO Error publishing events (retrying): write tcp 10.143.11.63:60216->10.143.5.44:5044: write: connection reset by peer
2018-08-09T11:40:12+05:30 ERR Failed to publish events caused by: write tcp 10.143.11.63:35788->10.143.63.26:5044: write: connection reset by peer
2018-08-09T11:40:12+05:30 INFO Error publishing events (retrying): write tcp 10.143.11.63:35788->10.143.63.26:5044: write: connection reset by peer
2018-08-09T11:40:12+05:30 ERR Failed to publish events caused by: write tcp 10.143.11.63:58490->10.143.63.29:5044: write: connection reset by peer
2018-08-09T11:40:12+05:30 INFO Error publishing events (retrying): write tcp 10.143.11.63:58490->10.143.63.29:5044: write: connection reset by peer
2018-08-09T11:40:12+05:30 ERR Failed to publish events caused by: write tcp 10.143.11.63:51944->10.143.5.41:5044: write: connection reset by peer
2018-08-09T11:40:12+05:30 INFO Error publishing events (retrying): write tcp 10.143.11.63:51944->10.143.5.41:5044: write: connection reset by peer
2018-08-09T11:40:12+05:30 ERR Failed to publish events caused by: write tcp 10.143.11.63:51946->10.143.5.41:5044: write: connection reset by peer
2018-08-09T11:40:12+05:30 INFO Error publishing events (retrying): write tcp 10.143.11.63:51946->10.143.5.41:5044: write: connection reset by peer
2018-08-09T11:40:12+05:30 ERR Failed to publish events caused by: write tcp 10.143.11.63:58496->10.143.63.29:5044: write: connection reset by peer
2018-08-09T11:40:12+05:30 INFO Error publishing events (retrying): write tcp 10.143.11.63:58496->10.143.63.29:5044: write: connection reset by peer

2

Perhaps Logstash can't keep up with the event rate? What's in the Logstash log?

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.