# Failed to publish events caused by: EOF,Failed to publish events caused by: client is not connected,Failed to publish events: client is not connected **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [August 13, 2019, 2:14pm UTC](https://discuss.elastic.co/t/failed-to-publish-events-caused-by-eof-failed-to-publish-events-caused-by-client-is-not-connected-failed-to-publish-events-client-is-not-connected/195042 "2019-08-13T14:14:59Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Mohammad.ali](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mohammad.ali/32/45665_2.png) [@Mohammad.ali](https://discuss.elastic.co/u/Mohammad.ali)\ **Post date:** [August 13, 2019, 2:14pm UTC](https://discuss.elastic.co/t/failed-to-publish-events-caused-by-eof-failed-to-publish-events-caused-by-client-is-not-connected-failed-to-publish-events-client-is-not-connected/195042/1 "2019-08-13T14:14:59Z")
Hello everyone, i have a very simple filebeat which send some simple log file to logstash which is running on another server,,after i start filebeat and logstash the log which i see from filebeat shows me the connection is established on the port i explicity defined (5060)...the firewall between these two servers are configured and telnet shows me there no problem for these two servers to communicate on that port..but i got these problems on my logs: Aug 13 18:28:36 my\_server filebeat[26429]: 2019-08-13T18:28:36.524+0430 INFO pipeline/output.go:95 Connecting to backoff(async(tcp://x.x.x.x:5060)) Aug 13 18:28:36 my\_server filebeat[26429]: 2019-08-13T18:28:36.525+0430 INFO pipeline/output.go:105 Connection to backoff(async(tcp://x.x.x.x:5060)) established . . . . . . ERROR logstash/async.go:256 Failed to publish events caused by: EOF Aug 13 18:29:36 my\_server filebeat[26429]: 2019-08-13T18:29:36.599+0430 ERROR logstash/async.go:256 Failed to publish events caused by: client is not connected Aug 13 18:29:38 my\_server filebeat[26429]: 2019-08-13T18:29:38.492+0430 ERROR pipeline/output.go:121 Failed to publish events: client is not connected Aug 13 18:29:38 my\_server filebeat[26429]: 2019-08-13T18:29:38.493+0430 INFO pipeline/output.go:95 Connecting to backoff(async(tcp://x.x.x.x:5060)) Aug 13 18:29:38 my\_server filebeat[26429]: 2019-08-13T18:29:38.493+0430 INFO pipeline/output.go:105 Connection to backoff(async(tcp://x.x.x.x:5060)) established Aug 13 18:29:40 my\_server systemd[1]: Stopping Filebeat sends log files to Logstash or directly to Elasticsearch.... Aug 13 18:29:40 my\_server filebeat[26429]: 2019-08-13T18:29:40.878+0430 INFO beater/filebeat.go:443 Stopping filebeat Aug 13 18:29:40 my\_server filebeat[26429]: 2019-08-13T18:29:40.878+0430 INFO crawler/crawler.go:139 Stopping Crawler Aug 13 18:29:40 my\_server filebeat[26429]: 2019-08-13T18:29:40.878+0430 INFO crawler/crawler.go:149 Stopping 1 inputs Aug 13 18:29:40 my\_server filebeat[26429]: 2019-08-13T18:29:40.878+0430 INFO cfgfile/reload.go:229 Dynamic config reloader stopped Aug 13 18:29:40 my\_server filebeat[26429]: 2019-08-13T18:29:40.878+0430 INFO input/input.go:149 input ticker stopped Aug 13 18:29:40 my\_server filebeat[26429]: 2019-08-13T18:29:40.878+0430 INFO input/input.go:167 Stopping Input: 6579502740723303628 Aug 13 18:29:40 my\_server filebeat[26429]: 2019-08-13T18:29:40.878+0430 INFO log/harvester.go:274 Reader was closed: /etc/filebeat/somelog.log. Closing. Aug 13 18:29:40 my\_server filebeat[26429]: 2019-08-13T18:29:40.878+0430 INFO crawler/crawler.go:165 Crawler stopped Aug 13 18:29:40 my\_server filebeat[26429]: 2019-08-13T18:29:40.878+0430 INFO registrar/registrar.go:367 Stopping Registrar Aug 13 18:29:40 my\_server filebeat[26429]: 2019-08-13T18:29:40.879+0430 INFO registrar/registrar.go:293 Ending Registrar ## My filebeat yaml file in SERVER A filebeat.inputs: - type: log paths: - /etc/filebeat/somelog.log output.logstash: hosts: ["X.X.X.X:5060"] ssl: enabled: false timeout: 500 * * * ## My logstash conf file in SERVER B input { beats { port =\> "5060" ssl =\> false } } filter { } output { elasticsearch { hosts =\> ["localhost:9200"] index =\> "testing" } } please consider i have no SSL cert configured yet and i tried to disabled (i do not know by defaults is active or not) ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [August 14, 2019, 9:32am UTC](https://discuss.elastic.co/t/failed-to-publish-events-caused-by-eof-failed-to-publish-events-caused-by-client-is-not-connected-failed-to-publish-events-client-is-not-connected/195042/2 "2019-08-14T09:32:34Z")
Looks like the connection is closed by Logstash, which force closes idle connections. See: [client\_inactivity\_timeout](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-beats.html#plugins-inputs-beats-client_inactivity_timeout) setting. The logstash output uses pipelining and is mostly asynchronous. This is why someone sometimes one sees followup errors. No events will be lost due to this in filebeat. Filebeat will just reconnect and continue sending once it was able to do so. ---
**Author:** ![Mohammad.ali](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mohammad.ali/32/45665_2.png) [@Mohammad.ali](https://discuss.elastic.co/u/Mohammad.ali)\ **Post date:** [August 21, 2019, 8:20am UTC](https://discuss.elastic.co/t/failed-to-publish-events-caused-by-eof-failed-to-publish-events-caused-by-client-is-not-connected-failed-to-publish-events-client-is-not-connected/195042/3 "2019-08-21T08:20:52Z")
Thx Alot for your reply..actually the problem was about network ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 18, 2019, 8:24am UTC](https://discuss.elastic.co/t/failed-to-publish-events-caused-by-eof-failed-to-publish-events-caused-by-client-is-not-connected-failed-to-publish-events-client-is-not-connected/195042/4 "2019-09-18T08:24:49Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.