ERR Failed to publish events caused by: write tcp

Hi,

I am continually getting an error in my file beat. Logs are writing at very very high speed.

filebeat configuration
##########start##############

filebeat:
prospectors:
-
paths:
- /logs/statistics.log
document_type: newlog

- 
  paths:
    - /logs/states.log
  fields_under_root: true
  document_type: txnstatus
  fields:
    json: true
  input_type: log

- 
  paths:
     - /logs/instaproxy.log
  document_type: payment
  input_type: log

- 
  paths:
     - /var/log/secure
  document_type: audit-logs
  input_type: log

registry_file: /var/lib/filebeat/registry
output:
logstash:
hosts: ["10.143.5.41:5044","10.143.5.42:5044","10.143.5.43:5044","10.143.5.44:5044","10.143.5.45:5044","10.143.4.49:5044","10.143.63.47:5044","10.143.63.29:5044","10.143.63.26:5044"]
#hosts: ["10.143.5.41:5045"]
loadbalance: true
worker: 6
shipper:
logging:
files:
path: logs/mybeat
name: mybeat.log
rotateeverybytes: 524288000 # = 50MB

#########END###############

2018-08-09T11:40:12+05:30 ERR Failed to publish events caused by: write tcp 10.143.11.63:34010->10.143.63.47:5044: write: connection reset by peer
2018-08-09T11:40:12+05:30 INFO Error publishing events (retrying): write tcp 10.143.11.63:34010->10.143.63.47:5044: write: connection reset by peer
2018-08-09T11:40:12+05:30 ERR Failed to publish events caused by: write tcp 10.143.11.63:44212->10.143.5.43:5044: write: connection reset by peer
2018-08-09T11:40:12+05:30 INFO Error publishing events (retrying): write tcp 10.143.11.63:44212->10.143.5.43:5044: write: connection reset by peer
2018-08-09T11:40:12+05:30 ERR Failed to publish events caused by: write tcp 10.143.11.63:60216->10.143.5.44:5044: write: connection reset by peer
2018-08-09T11:40:12+05:30 INFO Error publishing events (retrying): write tcp 10.143.11.63:60216->10.143.5.44:5044: write: connection reset by peer
2018-08-09T11:40:12+05:30 ERR Failed to publish events caused by: write tcp 10.143.11.63:35788->10.143.63.26:5044: write: connection reset by peer
2018-08-09T11:40:12+05:30 INFO Error publishing events (retrying): write tcp 10.143.11.63:35788->10.143.63.26:5044: write: connection reset by peer
2018-08-09T11:40:12+05:30 ERR Failed to publish events caused by: write tcp 10.143.11.63:58490->10.143.63.29:5044: write: connection reset by peer
2018-08-09T11:40:12+05:30 INFO Error publishing events (retrying): write tcp 10.143.11.63:58490->10.143.63.29:5044: write: connection reset by peer
2018-08-09T11:40:12+05:30 ERR Failed to publish events caused by: write tcp 10.143.11.63:51944->10.143.5.41:5044: write: connection reset by peer
2018-08-09T11:40:12+05:30 INFO Error publishing events (retrying): write tcp 10.143.11.63:51944->10.143.5.41:5044: write: connection reset by peer
2018-08-09T11:40:12+05:30 ERR Failed to publish events caused by: write tcp 10.143.11.63:51946->10.143.5.41:5044: write: connection reset by peer
2018-08-09T11:40:12+05:30 INFO Error publishing events (retrying): write tcp 10.143.11.63:51946->10.143.5.41:5044: write: connection reset by peer
2018-08-09T11:40:12+05:30 ERR Failed to publish events caused by: write tcp 10.143.11.63:58496->10.143.63.29:5044: write: connection reset by peer
2018-08-09T11:40:12+05:30 INFO Error publishing events (retrying): write tcp 10.143.11.63:58496->10.143.63.29:5044: write: connection reset by peer

Perhaps Logstash can't keep up with the event rate? What's in the Logstash log?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.