# Failed to connect to backoff - Filebeat and ELK in different environemnts with NAT **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [November 6, 2018, 11:42am UTC](https://discuss.elastic.co/t/failed-to-connect-to-backoff-filebeat-and-elk-in-different-environemnts-with-nat/155538 "2018-11-06T11:42:59Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Dan007](https://avatars.discourse-cdn.com/v4/letter/d/41988e/32.png) [@Dan007](https://discuss.elastic.co/u/Dan007)\ **Post date:** [November 6, 2018, 11:42am UTC](https://discuss.elastic.co/t/failed-to-connect-to-backoff-filebeat-and-elk-in-different-environemnts-with-nat/155538/1 "2018-11-06T11:42:59Z")
Hi, I have two different environments: in "environment-a" there is ELK stack running using docker containers, and in "environment-b" there is a dockerised application that should sent logs using filebeat. The environments use NAT system. This is my filebeat config: ``` filebeat.inputs: - type: log paths: - /var/tmp/app_*.log output.logstash: hosts: ["IP_ENV_A:5044"] ssl.verification_mode: none bulk_max_size: 1024 ``` This is the logstash config: input { beats { port =\> 5044 } } output { stdout { codec =\> rubydebug } } This is the error that I get in filebeat logs (the port "48538" change every time the ERROR is generated): ERROR pipeline/output.go:100 Failed to connect to backoff(async(tcp://IP\_ENV\_A:5044)): read tcp 172.x.x.x:48538-\>IP\_ENV\_A:5044: read: connection reset by peer I can telnet IP\_ENV\_A 5044. What's wrong? ---
**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\ **Post date:** [November 8, 2018, 2:50pm UTC](https://discuss.elastic.co/t/failed-to-connect-to-backoff-filebeat-and-elk-in-different-environemnts-with-nat/155538/2 "2018-11-08T14:50:58Z")
Do you see any errors in the logs of the output? Are you sure that Logstash is reachable from the container of Filebeat? ---
**Author:** ![Dan007](https://avatars.discourse-cdn.com/v4/letter/d/41988e/32.png) [@Dan007](https://discuss.elastic.co/u/Dan007)\ **Post date:** [November 8, 2018, 3:09pm UTC](https://discuss.elastic.co/t/failed-to-connect-to-backoff-filebeat-and-elk-in-different-environemnts-with-nat/155538/3 "2018-11-08T15:09:39Z")
The error that I read in filebeat logs is that one that I have already posted. Here below again: ERROR pipeline/output.go:100 Failed to connect to backoff(async(tcp://IP\_ENV\_A:5044)): read tcp 172.x.x.x:48538-\>IP\_ENV\_A:5044: read: connection reset by peer How can I be sure that Logstash container is reachable from filebeat container? I tried just to run a simple TCP server in Logstash container and a simple TCP client in filebeat container, and the communications work fine! Telnet works fine too. So I still don't understand what the problem is. Help please! ---
**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\ **Post date:** [November 8, 2018, 3:21pm UTC](https://discuss.elastic.co/t/failed-to-connect-to-backoff-filebeat-and-elk-in-different-environemnts-with-nat/155538/4 "2018-11-08T15:21:26Z")
Sorry if I was not clear. I mean if you see any error in the logs of Logstash. ---
**Author:** ![Dan007](https://avatars.discourse-cdn.com/v4/letter/d/41988e/32.png) [@Dan007](https://discuss.elastic.co/u/Dan007)\ **Post date:** [November 12, 2018, 11:34am UTC](https://discuss.elastic.co/t/failed-to-connect-to-backoff-filebeat-and-elk-in-different-environemnts-with-nat/155538/5 "2018-11-12T11:34:44Z")
The directory /var/log/logstash is empty. So I don't have logs... Any help to understand the problem? In Filebeat, sometimes I have got this error: 018-11-12T11:44:43.986Z ERROR pipeline/output.go:100 Failed to connect to backoff(async(tcp://IP\_ENV\_A:5088)): EOF ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [November 12, 2018, 9:12pm UTC](https://discuss.elastic.co/t/failed-to-connect-to-backoff-filebeat-and-elk-in-different-environemnts-with-nat/155538/6 "2018-11-12T21:12:57Z")
The error messages indicate the connection is closed, not be filebeat, but by LS, firewall or NAT device (e.g. due to timeout). ```auto read: connection reset by peer ``` This one indicates that filebeat did publish events, but the connection is closed while filebeat is waiting for the ACK from Logstash. This normally happens if Logstash is abnormally killed or if intermediate NAT devices/firewall just close connections due to internal timeouts. Normally Logstash sends a keep-alive signal the Filebeat while events are being processed, plus filebeat has an internal timeout if Logstash never responds or send the keep alive. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 10, 2018, 9:12pm UTC](https://discuss.elastic.co/t/failed-to-connect-to-backoff-filebeat-and-elk-in-different-environemnts-with-nat/155538/7 "2018-12-10T21:12:58Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.