# Failed to publish events

**URL:** <https://discuss.elastic.co/t/failed-to-publish-events/327090>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [March 6, 2023, 2:24pm UTC](https://discuss.elastic.co/t/failed-to-publish-events/327090 "2023-03-06T14:24:43Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![zaeemmasood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zaeemmasood/32/102383_2.png) [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\
**Post date:** [March 6, 2023, 2:24pm UTC](https://discuss.elastic.co/t/failed-to-publish-events/327090/1 "2023-03-06T14:24:43Z")

</div>

Hi All,

We see the following error in filebeat log resulting in loss of data:

```auto
pipeline/output.go:121 Failed to publish events: write tcp 19.14.25.26:42660->14.18.8.1:5044: write: connection reset by peer

```

It seems that filebeat is not able to push messages to the remote Logstash listening on port 5044.

This error is seen on numerous filebeat logs which makes me believe that the issue is on the Logstash side.

Question: What are the tuning parameters required for both Logstash and OS (RHEL 7) as I believe Logstash is getting swamped with messages?

---

<div class="post-metadata">

**Author:** ![zaeemmasood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zaeemmasood/32/102383_2.png) [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\
**Post date:** [March 6, 2023, 5:18pm UTC](https://discuss.elastic.co/t/failed-to-publish-events/327090/2 "2023-03-06T17:18:56Z")

</div>

Is this the recommended approach?

> **[Using parallel Logstash pipelines to improve persistent queue performance](https://www.elastic.co/blog/using-parallel-logstash-pipelines-to-improve-persistent-queue-performance)**
>
> Persistent queues provide durability of data within Logstash. Learn how to use multiple Logstash pipelines to improve persistent queues performance without sacrificing data ingest throughput.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 3, 2023, 5:19pm UTC](https://discuss.elastic.co/t/failed-to-publish-events/327090/3 "2023-04-03T17:19:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.