# Failed to publish events caused by: lumberjack protocol error

**URL:** <https://discuss.elastic.co/t/failed-to-publish-events-caused-by-lumberjack-protocol-error/185574>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [June 13, 2019, 8:19am UTC](https://discuss.elastic.co/t/failed-to-publish-events-caused-by-lumberjack-protocol-error/185574 "2019-06-13T08:19:48Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![lauea](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lauea/32/26743_2.png) [@lauea](https://discuss.elastic.co/u/lauea)\
**Post date:** [June 13, 2019, 8:19am UTC](https://discuss.elastic.co/t/failed-to-publish-events-caused-by-lumberjack-protocol-error/185574/1 "2019-06-13T08:19:48Z")

</div>

Hi All,

Here is the error.

```auto
transport] transport/client.go:131 closing
2019-06-13T08:07:06.252Z DEBUG [logstash] logstash/async.go:159 69 events out of 69 events sent to logstash host xxx.xxx..xxx:15044. Continue sending
2019-06-13T08:07:06.252Z DEBUG [logstash] logstash/async.go:116 close connection
2019-06-13T08:07:06.252Z ERROR logstash/async.go:256 Failed to publish events caused by: client is not connected
2019-06-13T08:07:06.252Z DEBUG [logstash] logstash/async.go:116 close connection
2019-06-13T08:07:07.387Z DEBUG [input] input/input.go:152 Run input
2019-06-13T08:07:07.387Z DEBUG [input] log/input.go:187 Start next scan
2019-06-13T08:07:07.388Z DEBUG [input] log/input.go:417 Check file for harvesting: /root/testlog/testing.log
2019-06-13T08:07:07.388Z DEBUG [input] log/input.go:507 Update existing file for harvesting: /root/testlog/testing.log, offset: 49
2019-06-13T08:07:07.388Z DEBUG [input] log/input.go:559 Harvester for file is still running: /root/testlog/testing.log
2019-06-13T08:07:07.388Z DEBUG [input] log/input.go:417 Check file for harvesting: /root/testlog/testing.log
2019-06-13T08:07:07.388Z DEBUG [input] log/input.go:507 Update existing file for harvesting: /root/testlog/testing.log, offset: 6988
2019-06-13T08:07:07.388Z DEBUG [input] log/input.go:559 Harvester for file is still running: /root/testlog/testing.log
2019-06-13T08:07:07.388Z DEBUG [input] log/input.go:417 Check file for harvesting: /root/testlog/multipleabc.log
2019-06-13T08:07:07.388Z DEBUG [input] log/input.go:507 Update existing file for harvesting: /root/testlog/multipleabc.log, offset: 6988
2019-06-13T08:07:07.388Z DEBUG [input] log/input.go:559 Harvester for file is still running: /root/testlog/multipleabc.log
2019-06-13T08:07:07.388Z DEBUG [input] log/input.go:208 input states cleaned up. Before: 3, After: 3, Pending: 0
2019-06-13T08:07:07.900Z ERROR pipeline/output.go:121 Failed to publish events: client is not connected
2019-06-13T08:07:07.900Z INFO pipeline/output.go:95 Connecting to backoff(async(tcp://xxx.xxx.xxx.xxx:15400))
2019-06-13T08:07:07.900Z DEBUG [logstash] logstash/async.go:111 connect
2019-06-13T08:07:08.015Z INFO pipeline/output.go:105 Connection to backoff(async(tcp://xxx.xxx.xxx.xxx:15400)) established
2019-06-13T08:07:08.017Z DEBUG [logstash] logstash/async.go:159 69 events out of 69 events sent to logstash host xxx.xxx.xxx.xxx:15400. Continue sending
2019-06-13T08:07:08.053Z ERROR logstash/async.go:256 Failed to publish events caused by: lumberjack protocol error
2019-06-13T08:07:08.053Z DEBUG [transport] transport/client.go:131 closing
2019-06-13T08:07:08.056Z DEBUG [logstash] logstash/async.go:159 69 events out of 69 events sent to logstash host xxx.xxx.xxx.xxx:15400. Continue sending
2019-06-13T08:07:08.056Z DEBUG [logstash] logstash/async.go:116 close connection
2019-06-13T08:07:08.056Z ERROR logstash/async.go:256 Failed to publish events caused by: client is not connected
2019-06-13T08:07:08.056Z DEBUG [logstash] logstash/async.go:116 close connection

```

filebeat config:

```auto
#----------------------------- Logstash output --------------------------------
output.logstash:
  # The Logstash hosts
  hosts: ["xxx.xxx.xxx.xxx:15400"]

  # Optional SSL. By default is off.
  # List of root certificates for HTTPS server verifications
  ssl.certificate_authorities: ["/etc/pki/ca_api/client/ca.crt"]

  # Certificate for SSL client authentication
  ssl.certificate: "/etc/pki/ca_api/client/client.crt"

  # Client Certificate Key
  ssl.key: "/etc/pki/ca_api/client/client.key"
  ssl.key_passphrase: "xxxxxxxx"

```

Logstash config:

```auto
input {
  beats {
    host => "0.0.0.0"
    port => 5044 # which pointer by xxx.xxx.xxx.xxx:15400
}
}

```

Anyone can help with above issue. Thanks.

---

<div class="post-metadata">

**Author:** ![shaunak](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shaunak/32/6643_2.png) [@shaunak](https://discuss.elastic.co/u/shaunak)\
**Post date:** [June 14, 2019, 6:46pm UTC](https://discuss.elastic.co/t/failed-to-publish-events-caused-by-lumberjack-protocol-error/185574/2 "2019-06-14T18:46:32Z")

</div>

Can you check if you are receiving any data on your Logstash machine from the Beats machine on port 5044?

One way to do this would be to temporarily stop your Logstash pipeline and run this on your Logstash machine:

```auto
nc -lp 5044 > /tmp/data
``

Then see if the size of `/tmp/data` is growing.
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 12, 2019, 6:46pm UTC](https://discuss.elastic.co/t/failed-to-publish-events-caused-by-lumberjack-protocol-error/185574/3 "2019-07-12T18:46:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.