Error publishing metricbeat to logstash

Elastic Stack Beats
1

Hi,
I have installed metricbeat on windows and configured it to send logs/metric to logstash. However it fails with below error message:

017-11-10T14:13:36+05:30 ERR Failed to publish events (host: 10.5.52.136:5044:10200), caused by: read tcp 10.5.52.168:61573->10.5.52.136:5044: i/o timeout
2017-11-10T14:13:36+05:30 INFO Error publishing events (retrying): read tcp 10.5.52.168:61573->10.5.52.136:5044: i/o timeout
2017-11-10T14:14:00+05:30 INFO Non-zero metrics in the last 30s: libbeat.logstash.publish.read_errors=1 libbeat.logstash.published_but_not_acked_events=1115
2017-11-10T14:14:30+05:30 INFO No non-zero metrics in the last 30s
2017-11-10T14:15:00+05:30 INFO Non-zero metrics in the last 30s: libbeat.logstash.call_count.PublishEvents=1 libbeat.logstash.publish.write_bytes=124910

Thanks.

3

Metricbeat is not receiving the ACK or the heartbeat signal (send every 5s) from logstash (default timeout is 60s).
Which version of Logstash are you using? How many beats have you send to Logstash?

4

logstash 5.6.3
Metricbeat and filebeat.

5

metricbeat version 5.6.4 (amd64), libbeat 5.6.4
Can the version be the issue?

6

installed 5.6.3, still getting same error.
2017-11-13T17:56:24+05:30 ERR Connecting error publishing events (retrying): dial tcp 10.5.52.136:5044: getsockopt: connection refused
2017-11-13T17:56:53+05:30 INFO No non-zero metrics in the last 30s
2017-11-13T17:57:23+05:30 INFO Non-zero metrics in the last 30s: libbeat.logstash.call_count.PublishEvents=1 libbeat.logstash.publish.read_bytes=6 libbeat.logstash.publish.write_bytes=617
2017-11-13T17:57:26+05:30 ERR Failed to publish events caused by: read tcp 10.5.52.196:51982->10.5.52.136:5044: i/o timeout
2017-11-13T17:57:26+05:30 INFO Error publishing events (retrying): read tcp 10.5.52.196:51982->10.5.52.136:5044: i/o timeout
2017-11-13T17:57:53+05:30 INFO Non-zero metrics in the last 30s: libbeat.logstash.call_count.PublishEvents=1 libbeat.logstash.publish.read_errors=1 libbeat.logstash.publish.write_bytes=223 libbeat.logstash.published_and_acked_events=1 libbeat.logstash.published_but_not_acked_events=366

7

Do you have any kind of devices/firewall in between? Connection refused and not even getting an ACK within 60s is quite weird.

How many beats have you send to Logstash?

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.