# Failed to publish events **URL:** \ **Category:** Beats\ **Tags:** packetbeat\ **Created:** [July 28, 2017, 3:05pm UTC](https://discuss.elastic.co/t/failed-to-publish-events/94983 "2017-07-28T15:05:38Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![pastperfect](https://avatars.discourse-cdn.com/v4/letter/p/7cd45c/32.png) [@pastperfect](https://discuss.elastic.co/u/pastperfect)\ **Post date:** [July 28, 2017, 3:05pm UTC](https://discuss.elastic.co/t/failed-to-publish-events/94983/1 "2017-07-28T15:05:38Z")
I have set up packetbeat on a single client workstation alongside winlogbeat. When running packetbeat it doesn't seem to send the data through to my logstash server. These are the errors I get: - ERR Failed to publish events caused by: read tcp 10.112.70.96:57164-\>10.112.7.76:5044: wsarecv: An existing connection was forcibly closed by the remote host. - ERR Connecting error publishing events (retrying): dial tcp 10.112.7.76:5044: connectex: No connection could be made because the target machine actively refused it. Winlogbeat has started to show the same error l but its events seem to be written OK to elasticsearch. This is my logstash config: > input { > beats { > port =\> 5044 > } > } > > filter { > if [event\_id] \> 0 { > translate{ > dictionary =\> [ > "4624", "Successful Logon", > "4625", "Failed Logon", > "4648", "A logon was attempted using explicit credentials", > "4720", "A user account was created", > "4722", "A user account was enabled", > "4723", "An attempt was made to change an account's password", > "4724", "An attempt was made to reset an accounts password", > "4725", "A user account was disabled", > "4726", "A user account was deleted", > "4738", "A user account was changed", > "4740", "A user account was locked out", > "4767", "A user account was unlocked", > "4781", "The name of an account was changed", > "4782", "The password hash an account was accessed" > ] > field =\> "event\_id" > destination =\> "Event\_Translation" > } > } > } > > output { > elasticsearch { > hosts =\> "ABZELK02:9200" > manage\_template =\> false > index =\> "%{[@metadata][beat]}-%{+YYYY.MM}" > document\_type =\> "%{[@metadata][type]}" > } > } Here is my Packetbeat config file: > packetbeat.interfaces.device: 1 > > packetbeat.flows: > > timeout: 30s > > period: 10s > > packetbeat.protocols.icmp: > enabled: true > > packetbeat.protocols.amqp: > ports: [5672] > > packetbeat.protocols.cassandra: > ports: [9042] > > packetbeat.protocols.dns: > ports: [53] > > include\_authorities: true > include\_additionals: true > > packetbeat.protocols.http: > ports: [80, 8080, 8000, 5000, 8002] > > packetbeat.protocols.memcache: > ports: [11211] > > packetbeat.protocols.mysql: > ports: [3306] > > packetbeat.protocols.pgsql: > ports: [5432] > > packetbeat.protocols.redis: > ports: [6379] > > packetbeat.protocols.thrift: > ports: [9090] > > packetbeat.protocols.mongodb: > ports: [27017] > > packetbeat.protocols.nfs: > ports: [2049] > > tags: ["PacketBeat-Test"] > > output.logstash: > > hosts: ["10.112.7.76:5044"] ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [July 28, 2017, 4:08pm UTC](https://discuss.elastic.co/t/failed-to-publish-events/94983/2 "2017-07-28T16:08:24Z")
> [@pastperfect](#): > > wsarecv: An existing connection was forcibly closed by the remote host. Sounds like something is blocking the connection. Is there a firewall blocking the connection? Are you sure Logstash is running and listening (what does `sudo netstat -anp | grep 5044` show on the Logstash side?). ---
**Author:** ![pastperfect](https://avatars.discourse-cdn.com/v4/letter/p/7cd45c/32.png) [@pastperfect](https://discuss.elastic.co/u/pastperfect)\ **Post date:** [July 31, 2017, 9:54am UTC](https://discuss.elastic.co/t/failed-to-publish-events/94983/3 "2017-07-31T09:54:01Z")
Thanks for getting back to me. The firewall was my first thought as well but if it was blocking it I wouldn't expect to see any of the winlogbeat stuff getting through. I'm running just a single ELK server on Server 2012 and couldn't see anything connecting on 5044 in netstat. Here is a dump from netstat: [https://pastebin.com/Q1Zexccw](https://pastebin.com/Q1Zexccw) ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [August 1, 2017, 1:09am UTC](https://discuss.elastic.co/t/failed-to-publish-events/94983/4 "2017-08-01T01:09:24Z")
Are you sure Logstash is running? There should a listening socket on 5044 if Logstash is running. ---
**Author:** ![pastperfect](https://avatars.discourse-cdn.com/v4/letter/p/7cd45c/32.png) [@pastperfect](https://discuss.elastic.co/u/pastperfect)\ **Post date:** [August 1, 2017, 11:03am UTC](https://discuss.elastic.co/t/failed-to-publish-events/94983/5 "2017-08-01T11:03:52Z")
Yeah 100% sure, I have events being logged with the logstash translate function: [![](https://i.imgur.com/DBdlgWy.png) ](https://i.imgur.com/DBdlgWy.png) ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [August 1, 2017, 12:53pm UTC](https://discuss.elastic.co/t/failed-to-publish-events/94983/6 "2017-08-01T12:53:47Z")
If it's not listening on 5044 then I would double check that it's running the config file with the beats input defined and look through the Logstash logs to see if there are any issues. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 29, 2017, 12:54pm UTC](https://discuss.elastic.co/t/failed-to-publish-events/94983/7 "2017-08-29T12:54:09Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.