Hi,
I am trying to send logs from Filebeat to Logstash
Filebeat 5.5.2 (Centos 6.9)
Logstash 5.5.2 (Windows Server 2008)
But I am getting an error:
INFO Error publishing events (retrying): read tcp ****** ->*****:5044: wsarecv: An established connection was aborted by the software in your host machine.
Error occures only for long events (i.e. 30000 characters) for short events logs are successfuly send to logstash -> elasticsearch and are visible in kibana.
Filebeat configuration:
filebeat.prospectors:
- input_type: log
paths:
- D:\Logs\*
multiline.pattern: '(--+)'
multiline.negate: true
multiline.match: after
multiline.max_lines: 10000
max_bytes: 10000000
ignore_older: 24h
output.logstash:
hosts: ["IP.ADD.RE.SS:5044"]
logging.level: debug
Logstash Pipeline:
input {
beats {
port => 5044
client_inactivity_timeout => 60
}
}
output {
elasticsearch {
hosts => ["IP.AD.DR.ESS:9200"]
index => "test-%{+YYYY.MM.dd}"
user => someuser
password => somepassword
}
}