# Failed to publish events caused by: write tcp X.X.X.X:36524-\>X.X.X.X:5044: write: connection reset by peer error in filebeat

**URL:** <https://discuss.elastic.co/t/failed-to-publish-events-caused-by-write-tcp-x-x-x-x-36524-x-x-x-x-write-connection-reset-by-peer-error-in-filebeat/237031>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [June 14, 2020, 4:53pm UTC](https://discuss.elastic.co/t/failed-to-publish-events-caused-by-write-tcp-x-x-x-x-36524-x-x-x-x-write-connection-reset-by-peer-error-in-filebeat/237031 "2020-06-14T16:53:05Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Aqel](https://avatars.discourse-cdn.com/v4/letter/a/9de053/32.png) [@Aqel](https://discuss.elastic.co/u/Aqel)\
**Post date:** [June 14, 2020, 4:53pm UTC](https://discuss.elastic.co/t/failed-to-publish-events-caused-by-write-tcp-x-x-x-x-36524-x-x-x-x-write-connection-reset-by-peer-error-in-filebeat/237031/1 "2020-06-14T16:53:05Z")

</div>

I am getting this error while trying to push logs using filebeat to logstash.

```
|filebeat | 2020-06-14T16:45:36.660318702Z 2020-06-14T16:45:36.660Z|ERROR|logstash/async.go:256|Failed to publish events caused by: write tcp X.X.X.X:36524->X.X.X.X:5044: write: connection reset by peer|
|---|---|---|---|
|filebeat | 2020-06-14T16:45:38.013422207Z 2020-06-14T16:45:38.012Z|ERROR|pipeline/output.go:121|Failed to publish events: write tcp X.X.X.X:36524->X.X.X.X:5044: write: connection reset by peer|
|filebeat | 2020-06-14T16:45:38.013457133Z 2020-06-14T16:45:38.012Z|INFO|pipeline/output.go:95|Connecting to backoff(async(tcp://xx.xx:5044))|

```

Can someone please help me ?

My logstash pipelines

**02-beats-input.conf**

```
input {
  beats {
    port => 5044
  }
}

```

**10-syslog-filter.conf**

```
filter {
    json {
    	source => "message"
    }
}

```

**30-elasticsearch-output.conf**

```
output {
  elasticsearch {
    hosts => ["localhost:9200"]
    manage_template => false
    index => "index-%{+YYYY.MM.dd}"
  }
}

```

When I do `telnet xx.xx 5044`, this is the what I see in terminal

```auto
Trying X.X.X.X...
Connected to ace.elastic.
Escape character is '^]'

```

> NOTE : This configuration used to work before and I have not changed anything related to logstash or filebeat.

---

<div class="post-metadata">

**Author:** ![Coinology](https://avatars.discourse-cdn.com/v4/letter/c/3e96dc/32.png) [@Coinology](https://discuss.elastic.co/u/Coinology)\
**Post date:** [June 14, 2020, 6:21pm UTC](https://discuss.elastic.co/t/failed-to-publish-events-caused-by-write-tcp-x-x-x-x-36524-x-x-x-x-write-connection-reset-by-peer-error-in-filebeat/237031/2 "2020-06-14T18:21:08Z")

</div>

@Aqel Welcome to the community!

It'd be helpful to see your Filebeat config / Logstash pipeline. Also, please use the formatting features here on the forum when posting logs / code (the \</\> button or you can use pairs of `).

---

<div class="post-metadata">

**Author:** ![Aqel](https://avatars.discourse-cdn.com/v4/letter/a/9de053/32.png) [@Aqel](https://discuss.elastic.co/u/Aqel)\
**Post date:** [June 15, 2020, 1:50am UTC](https://discuss.elastic.co/t/failed-to-publish-events-caused-by-write-tcp-x-x-x-x-36524-x-x-x-x-write-connection-reset-by-peer-error-in-filebeat/237031/3 "2020-06-15T01:50:30Z")

</div>

@Coinology Thanks for the comment. I have formatted the description and added the logstash pipelines.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 13, 2020, 3:50am UTC](https://discuss.elastic.co/t/failed-to-publish-events-caused-by-write-tcp-x-x-x-x-36524-x-x-x-x-write-connection-reset-by-peer-error-in-filebeat/237031/4 "2020-07-13T03:50:34Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.