# Error publishing metricbeat to logstash

**URL:** <https://discuss.elastic.co/t/error-publishing-metricbeat-to-logstash/107157>\
**Category:** Beats\
**Tags:** metricbeat\
**Created:** [November 10, 2017, 8:48am UTC](https://discuss.elastic.co/t/error-publishing-metricbeat-to-logstash/107157 "2017-11-10T08:48:08Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Parthgandhi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/parthgandhi/32/22742_2.png) [@Parthgandhi](https://discuss.elastic.co/u/Parthgandhi)\
**Post date:** [November 10, 2017, 8:48am UTC](https://discuss.elastic.co/t/error-publishing-metricbeat-to-logstash/107157/1 "2017-11-10T08:48:08Z")

</div>

Hi,  
I have installed metricbeat on windows and configured it to send logs/metric to logstash. However it fails with below error message:

017-11-10T14:13:36+05:30 ERR Failed to publish events (host: 10.5.52.136:5044:10200), caused by: read tcp 10.5.52.168:61573-\>10.5.52.136:5044: i/o timeout  
2017-11-10T14:13:36+05:30 INFO Error publishing events (retrying): read tcp 10.5.52.168:61573-\>10.5.52.136:5044: i/o timeout  
2017-11-10T14:14:00+05:30 INFO Non-zero metrics in the last 30s: libbeat.logstash.publish.read\_errors=1 libbeat.logstash.published\_but\_not\_acked\_events=1115  
2017-11-10T14:14:30+05:30 INFO No non-zero metrics in the last 30s  
2017-11-10T14:15:00+05:30 INFO Non-zero metrics in the last 30s: libbeat.logstash.call\_count.PublishEvents=1 libbeat.logstash.publish.write\_bytes=124910

Thanks.

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [November 10, 2017, 12:50pm UTC](https://discuss.elastic.co/t/error-publishing-metricbeat-to-logstash/107157/3 "2017-11-10T12:50:11Z")

</div>

Metricbeat is not receiving the ACK or the heartbeat signal (send every 5s) from logstash (default timeout is 60s).  
Which version of Logstash are you using? How many beats have you send to Logstash?

---

<div class="post-metadata">

**Author:** ![Parthgandhi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/parthgandhi/32/22742_2.png) [@Parthgandhi](https://discuss.elastic.co/u/Parthgandhi)\
**Post date:** [November 13, 2017, 11:51am UTC](https://discuss.elastic.co/t/error-publishing-metricbeat-to-logstash/107157/4 "2017-11-13T11:51:52Z")

</div>

logstash 5.6.3  
Metricbeat and filebeat.

---

<div class="post-metadata">

**Author:** ![Parthgandhi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/parthgandhi/32/22742_2.png) [@Parthgandhi](https://discuss.elastic.co/u/Parthgandhi)\
**Post date:** [November 13, 2017, 11:52am UTC](https://discuss.elastic.co/t/error-publishing-metricbeat-to-logstash/107157/5 "2017-11-13T11:52:55Z")

</div>

metricbeat version 5.6.4 (amd64), libbeat 5.6.4  
Can the version be the issue?

---

<div class="post-metadata">

**Author:** ![Parthgandhi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/parthgandhi/32/22742_2.png) [@Parthgandhi](https://discuss.elastic.co/u/Parthgandhi)\
**Post date:** [November 13, 2017, 12:28pm UTC](https://discuss.elastic.co/t/error-publishing-metricbeat-to-logstash/107157/6 "2017-11-13T12:28:24Z")

</div>

installed 5.6.3, still getting same error.  
2017-11-13T17:56:24+05:30 ERR Connecting error publishing events (retrying): dial tcp 10.5.52.136:5044: getsockopt: connection refused  
2017-11-13T17:56:53+05:30 INFO No non-zero metrics in the last 30s  
2017-11-13T17:57:23+05:30 INFO Non-zero metrics in the last 30s: libbeat.logstash.call\_count.PublishEvents=1 libbeat.logstash.publish.read\_bytes=6 libbeat.logstash.publish.write\_bytes=617  
2017-11-13T17:57:26+05:30 ERR Failed to publish events caused by: read tcp 10.5.52.196:51982-\>10.5.52.136:5044: i/o timeout  
2017-11-13T17:57:26+05:30 INFO Error publishing events (retrying): read tcp 10.5.52.196:51982-\>10.5.52.136:5044: i/o timeout  
2017-11-13T17:57:53+05:30 INFO Non-zero metrics in the last 30s: libbeat.logstash.call\_count.PublishEvents=1 libbeat.logstash.publish.read\_errors=1 libbeat.logstash.publish.write\_bytes=223 libbeat.logstash.published\_and\_acked\_events=1 libbeat.logstash.published\_but\_not\_acked\_events=366

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [November 13, 2017, 6:33pm UTC](https://discuss.elastic.co/t/error-publishing-metricbeat-to-logstash/107157/7 "2017-11-13T18:33:16Z")

</div>

Do you have any kind of devices/firewall in between? Connection refused and not even getting an ACK within 60s is quite weird.

How many beats have you send to Logstash?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 11, 2017, 6:33pm UTC](https://discuss.elastic.co/t/error-publishing-metricbeat-to-logstash/107157/8 "2017-12-11T18:33:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
