# Failed to publish events caused by: read tcp **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [January 31, 2020, 3:13pm UTC](https://discuss.elastic.co/t/failed-to-publish-events-caused-by-read-tcp/217410 "2020-01-31T15:13:08Z")\ **Posts on this page:** 16\ **Page:** 1
**Author:** ![daz1761](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/daz1761/32/61856_2.png) [@daz1761](https://discuss.elastic.co/u/daz1761)\ **Post date:** [January 31, 2020, 3:13pm UTC](https://discuss.elastic.co/t/failed-to-publish-events-caused-by-read-tcp/217410/1 "2020-01-31T15:13:08Z")
I am new to ELK, and I noticed these ERROR logs coming from the Filebeat Docker container: ``` filebeat | 2020-01-31T14:27:27.422Z ERROR logstash/async.go:256 Failed to publish events caused by: read tcp 172.22.0.3:59058->172.22.0.4:5044: i/o timeout filebeat | 2020-01-31T14:27:27.451Z ERROR logstash/async.go:256 Failed to publish events caused by: client is not connected filebeat | 2020-01-31T14:27:28.761Z ERROR pipeline/output.go:121 Failed to publish events: client is not connected ``` I am logging from a local dummy log file (see [https://github.com/moryachok/elasticstack-lab](https://github.com/moryachok/elasticstack-lab)) Everything seems to be fine though in Kibana after creating the index pattern, and I was just wondering if this is something serious or not. ---
**Author:** ![stappers](https://avatars.discourse-cdn.com/v4/letter/s/df705f/32.png) [@stappers](https://discuss.elastic.co/u/stappers)\ **Post date:** [February 4, 2020, 2:16pm UTC](https://discuss.elastic.co/t/failed-to-publish-events-caused-by-read-tcp/217410/2 "2020-02-04T14:16:21Z")
For What Its Worth: I do have same annoying ```auto logstash/async.go:256 Failed to publish events caused by: read tcp 192.0.2.3:59058->192.0.2.4:5044: i/o timeout ``` error. In [ERROR logstash/async.go:256 Failed to publish events caused by: write tcp 10.XXX.XX.XX:43522-\>10.XXX.XX.XX:5044: i/o timeout 2019-08-06T16:04:30.967+0800 ERROR pipeline/output.go:121 Failed to publish events:IOtimeout](https://discuss.elastic.co/t/error-logstash-async-go-256-failed-to-publish-events-caused-by-write-tcp-10-xxx-xx-xx-43522-10-xxx-xx-xx-i-o-timeout-2019-08-06t1630-967-0800-error-pipeline-output-go-121-failed-to-publish-events-iotimeout/194355) is it also reported (and closed after 28 days) Pointers on what to check (journalbeat side or the logstash side) are welcome. ---
**Author:** ![stappers](https://avatars.discourse-cdn.com/v4/letter/s/df705f/32.png) [@stappers](https://discuss.elastic.co/u/stappers)\ **Post date:** [February 5, 2020, 8:59am UTC](https://discuss.elastic.co/t/failed-to-publish-events-caused-by-read-tcp/217410/3 "2020-02-05T08:59:46Z")
Allocating/Assigning more memory for JVM of logstash does not help. With ```auto logger.elasticsearchoutput.name = logstash.outputs.elasticsearch logger.elasticsearchoutput.level = debug ``` added to `/etc/logstash/log4j2.properties` did I not get clues indicating what is causing this. So please share your thoughts about this issue. ---
**Author:** ![Admax0](https://avatars.discourse-cdn.com/v4/letter/a/f1d935/32.png) [@Admax0](https://discuss.elastic.co/u/Admax0)\ **Post date:** [February 5, 2020, 2:17pm UTC](https://discuss.elastic.co/t/failed-to-publish-events-caused-by-read-tcp/217410/4 "2020-02-05T14:17:39Z")
Hi, Which version of the stack are you using ? Are you running the stack on Docker ? ---
**Author:** ![stappers](https://avatars.discourse-cdn.com/v4/letter/s/df705f/32.png) [@stappers](https://discuss.elastic.co/u/stappers)\ **Post date:** [February 5, 2020, 2:38pm UTC](https://discuss.elastic.co/t/failed-to-publish-events-caused-by-read-tcp/217410/5 "2020-02-05T14:38:04Z")
7.5.2 With **out** `docker` ( the original poster is / was using `docker` ) ```auto $ dpkg -l logstash | grep ^ii ii logstash 1:7.5.2-1 all An extensible logging pipeline $ dpkg -l elasticsearch | grep ^ii ii elasticsearch 7.5.2 amd64 Distributed RESTful search engine built for the cloud $ dpkg -l kibana | grep ^ii ii kibana 7.5.2 amd64 Explore and visualize your Elasticsearch data ``` and at client side ```auto $ dpkg -l journalbeat | grep ^ii ii journalbeat 7.5.2 amd64 Journalbeat ships systemd journal entries to Elasticsearch or Logstash. ``` ---
**Author:** ![Admax0](https://avatars.discourse-cdn.com/v4/letter/a/f1d935/32.png) [@Admax0](https://discuss.elastic.co/u/Admax0)\ **Post date:** [February 5, 2020, 2:42pm UTC](https://discuss.elastic.co/t/failed-to-publish-events-caused-by-read-tcp/217410/6 "2020-02-05T14:42:21Z")
Okay thanks. I had the stack running on docker perfectly fine with the version 7.5.1. This specific error started to appear when I switched to 7.5.2. I had changed nothing to the configuration of anything from the stack. I suggest you try rolling back to 7.5.1 and see what happens. ---
**Author:** ![stappers](https://avatars.discourse-cdn.com/v4/letter/s/df705f/32.png) [@stappers](https://discuss.elastic.co/u/stappers)\ **Post date:** [February 5, 2020, 4:43pm UTC](https://discuss.elastic.co/t/failed-to-publish-events-caused-by-read-tcp/217410/7 "2020-02-05T16:43:34Z")
Good advice. The problem indeed emerged roughly around the time from 7.5.1 to 7.5.2 switch. > [@Admax0](#): > > try rolling back to 7.5.1 and see what happens It still works, including the problem ... ---
**Author:** ![daz1761](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/daz1761/32/61856_2.png) [@daz1761](https://discuss.elastic.co/u/daz1761)\ **Post date:** [February 6, 2020, 8:24am UTC](https://discuss.elastic.co/t/failed-to-publish-events-caused-by-read-tcp/217410/8 "2020-02-06T08:24:36Z")
Yes I'm on 7.5.2 also and I am running Docker containers. I am only experimenting at the moment, so I'll change everything in the Docker Compose file to 7.5.1 at some point. ---
**Author:** ![runtman](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/runtman/32/18136_2.png) [@runtman](https://discuss.elastic.co/u/runtman)\ **Post date:** [February 6, 2020, 1:53pm UTC](https://discuss.elastic.co/t/failed-to-publish-events-caused-by-read-tcp/217410/9 "2020-02-06T13:53:22Z")
I have this as well, I also posted a thread. Logs reach ES fine through logstash but I get these errors every 1-2 minutes. ---
**Author:** ![stappers](https://avatars.discourse-cdn.com/v4/letter/s/df705f/32.png) [@stappers](https://discuss.elastic.co/u/stappers)\ **Post date:** [February 7, 2020, 11:38am UTC](https://discuss.elastic.co/t/failed-to-publish-events-caused-by-read-tcp/217410/10 "2020-02-07T11:38:18Z")
> [@runtman](#): > > Logs reach ES fine through logstash but I get these errors every 1-2 minutes. Yes, same here. Changed `journalbeat` side. Sharing that modification and my thoughts about it here. Your review is appreciated. ```auto commit 8add1b95454f19ca87eda22849a36054e01d39d6 Author: Geert Stappers Date: Fri Feb 7 11:46:33 2020 +0100 Patience to journalbeat Set time-out of journalbeat to 90*60 seconds. At logstash side is "client idle time-out" set to 75*60 seconds. Those seventy-five minutes idle-time-out are one hour plus a quarter. The hour is based on that clients talk at least once a hour to logstash. (the extra quarters are indeed a fat margin) What the effect of the 90*60, 5400, seconds patience is when there is no logstash server is UNKNOWN. This change prevents (suppresses?) ERROR logstash/async.go:256 Failed to publish events caused by: read tcp journalbeatclient:43108->logstashserver:5044: i/o timeout ERROR logstash/async.go:256 Failed to publish events caused by: client is not connected ERROR pipeline/output.go:121 Failed to publish events: client is not connected as detected (triggered?) by the journalbeat client. Why this time-out setting is needed after several month with a need, is UNKNOWN. diff --git a/salt/srv/salt/core/etc/journalbeat/journalbeat.yml b/salt/srv/salt/core/etc/journalbeat/journalbeat.yml index 5164f0d0..19eb5f3e 100644 --- a/salt/srv/salt/core/etc/journalbeat/journalbeat.yml +++ b/salt/srv/salt/core/etc/journalbeat/journalbeat.yml @@ -127,6 +127,9 @@ setup.kibana: output.logstash: # The Logstash hosts hosts: ["minerva-logserver:5044"] + # and have patience with those hosts + timeout: 5400 # seconds + # (see also the commit message from 2020-02-07) # Optional SSL. By default is off. # List of root certificates for HTTPS server verifications ``` ---
**Author:** ![stappers](https://avatars.discourse-cdn.com/v4/letter/s/df705f/32.png) [@stappers](https://discuss.elastic.co/u/stappers)\ **Post date:** [February 7, 2020, 11:40am UTC](https://discuss.elastic.co/t/failed-to-publish-events-caused-by-read-tcp/217410/11 "2020-02-07T11:40:33Z")
> [@runtman](#): > > I also posted a thread Where? And more important: has that location (URL) a pointer to here?? ---
**Author:** ![runtman](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/runtman/32/18136_2.png) [@runtman](https://discuss.elastic.co/u/runtman)\ **Post date:** [February 7, 2020, 2:16pm UTC](https://discuss.elastic.co/t/failed-to-publish-events-caused-by-read-tcp/217410/12 "2020-02-07T14:16:37Z")
> [@Intermittent timeouts (Doesn't appear to stop service)](https://discuss.elastic.co/t/intermittent-timeouts-doesnt-appear-to-stop-service/218132): > > Hello, so we are starting a project where we are moving to ELK 7, with the Elasticsearch and Kibana being offered by [elastic.co](http://elastic.co) rather than self hosted. In our ELK6 install, I had a Nginx loadbalancer balancing our logstash nodes, this time round i've opted to use a AWS Network load balancer. Despite logs reaching Logstash absolutely fine, in the Filebeat logs I do see this, usually every minute. |2020-02-06T09:31:25.235Z|ERROR|logstash/async.go:256|Failed to publish events caused by: read tc… Here you go, i'll mention this thread now. ---
**Author:** ![runtman](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/runtman/32/18136_2.png) [@runtman](https://discuss.elastic.co/u/runtman)\ **Post date:** [February 12, 2020, 9:55am UTC](https://discuss.elastic.co/t/failed-to-publish-events-caused-by-read-tcp/217410/13 "2020-02-12T09:55:44Z")
Did you see the fixes I applied in my thread? ---
**Author:** ![Laszlo\_Kis](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/laszlo_kis/32/48738_2.png) [@Laszlo\_Kis](https://discuss.elastic.co/u/Laszlo_Kis)\ **Post date:** [February 12, 2020, 1:47pm UTC](https://discuss.elastic.co/t/failed-to-publish-events-caused-by-read-tcp/217410/14 "2020-02-12T13:47:01Z")
experinced the same issue with 7.5.2 (docker) so I'm using 7.5.1 ---
**Author:** ![VBDave](https://avatars.discourse-cdn.com/v4/letter/v/ecb155/32.png) [@VBDave](https://discuss.elastic.co/u/VBDave)\ **Post date:** [February 12, 2020, 11:00pm UTC](https://discuss.elastic.co/t/failed-to-publish-events-caused-by-read-tcp/217410/15 "2020-02-12T23:00:35Z")
I actually found increasing timeouts in logstash and filebeat **did not** fix it for me - after spending a few days on this, I have found this is due to a bug in the Beats input of Logstash: [https://github.com/elastic/logstash/issues/11540](https://github.com/elastic/logstash/issues/11540) I resolved it by upgrading my ELK stack to 7.6.0 but you can just upgrade the plugin in Logstash if required by following the command in the above git issue. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 11, 2020, 11:00pm UTC](https://discuss.elastic.co/t/failed-to-publish-events-caused-by-read-tcp/217410/16 "2020-03-11T23:00:37Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.