The connection is established, but eventually closed by Logstash or the machine Logstash runs on. When Filebeat tries to publish it get a 'TCP RST' package notifying it the connection has actually been closed.
Which Logstash/Filebeat versions are you using?
Is there a chance filebeat didn't send any data for a "long" time?
Normally filebeat tries to reconnect. No events are dropped.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.