# Filebeat configuration assistance

**URL:** <https://discuss.elastic.co/t/filebeat-configuration-assistance/133352>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [May 25, 2018, 6:29pm UTC](https://discuss.elastic.co/t/filebeat-configuration-assistance/133352 "2018-05-25T18:29:14Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![jaysundu](https://avatars.discourse-cdn.com/v4/letter/j/cc9497/32.png) [@jaysundu](https://discuss.elastic.co/u/jaysundu)\
**Post date:** [May 25, 2018, 6:29pm UTC](https://discuss.elastic.co/t/filebeat-configuration-assistance/133352/1 "2018-05-25T18:29:15Z")

</div>

I have the ELK stack installed on a Linux Centos 7 machine and am able to ingest from another Linux machine. But I'm unable to ingest from a Windows 2012 Server. Here is my configuration:

on linux, 02-beats-input.conf:

```auto
input {
  beats {
    port => 5044
    ssl => false
    ssl_certificate => "/etc/pki/tls/certs/logstash-forwarder.crt"
    ssl_key => "/etc/pki/tls/private/logstash-forwarder.key"
  }
}

```

on Windows, filebeat.yml:

```auto
filebeat.prospectors:
 - type: log
   paths:
     - c:\temp\messages
output.logstash:
  hosts: ["169.229.7.147:5044"]
  bulk_max_size: 1024

```

on Windows, filebeat log file:

```auto
2018-05-25T10:46:35.604-0700	INFO	instance/beat.go:468	Home path: [C:\Program Files\Filebeat] Config path: [C:\Program Files\Filebeat] Data path: [C:\\ProgramData\\filebeat] Logs path: [C:\\ProgramData\\filebeat\logs]
2018-05-25T10:46:35.605-0700	INFO	instance/beat.go:475	Beat UUID: 40df7e2e-48e9-4000-9d16-af254728ea06
2018-05-25T10:46:35.605-0700	INFO	instance/beat.go:213	Setup Beat: filebeat; Version: 6.2.4
2018-05-25T10:46:35.605-0700	INFO	pipeline/module.go:76	Beat name: maxdev
2018-05-25T10:46:35.606-0700	INFO	[monitoring]	log/log.go:97	Starting metrics logging every 30s
2018-05-25T10:46:35.606-0700	INFO	instance/beat.go:301	filebeat start running.
2018-05-25T10:46:35.606-0700	INFO	registrar/registrar.go:110	Loading registrar data from C:\ProgramData\filebeat\registry
2018-05-25T10:46:35.606-0700	INFO	registrar/registrar.go:121	States Loaded from registrar: 4
2018-05-25T10:46:35.606-0700	WARN	beater/filebeat.go:261	Filebeat is unable to load the Ingest Node pipelines for the configured modules because the Elasticsearch output is not configured/enabled. If you have already loaded the Ingest Node pipelines or are using Logstash pipelines, you can ignore this warning.
2018-05-25T10:46:35.606-0700	INFO	crawler/crawler.go:48	Loading Prospectors: 1
2018-05-25T10:46:35.607-0700	INFO	log/prospector.go:111	Configured paths: [c:\temp\messages]
2018-05-25T10:46:35.607-0700	INFO	crawler/crawler.go:82	Loading and starting Prospectors completed. Enabled prospectors: 1
2018-05-25T10:46:35.607-0700	INFO	log/harvester.go:216	Harvester started for file: c:\temp\messages
2018-05-25T10:46:35.945-0700	ERROR	logstash/async.go:235	Failed to publish events caused by: read tcp 128.32.154.165:65161->169.229.7.147:5044: wsarecv: An existing connection was forcibly closed by the remote host.

```

Please let me know what the issue might be. Thanks!

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [May 26, 2018, 1:53am UTC](https://discuss.elastic.co/t/filebeat-configuration-assistance/133352/2 "2018-05-26T01:53:33Z")

</div>

> [@jaysundu](#):
>
> wsarecv: An existing connection was forcibly closed by the remote host.

That usually means the connection was reset with a `RST` from the server. Can you look through the Logstash logs for errors (if you start logstash with `--debug` you'll get more verbose logging).

You should be able to recreate the issue by running this command from the Windows host: `.\filebeat test output -e -d "*"`

---

<div class="post-metadata">

**Author:** ![jaysundu](https://avatars.discourse-cdn.com/v4/letter/j/cc9497/32.png) [@jaysundu](https://discuss.elastic.co/u/jaysundu)\
**Post date:** [May 29, 2018, 10:08pm UTC](https://discuss.elastic.co/t/filebeat-configuration-assistance/133352/3 "2018-05-29T22:08:49Z")

</div>

Thank you for helping.

When I run .\filebeat test output -e -d "\*" I get the following:

{:timestamp=\>"2018-05-29T11:21:58.036000-0700", :message=\>"Beats inputs: accepting a new connection", :peer=\>"128.32.154.165:32067", :level=\>:debug, :file=\>"logstash/inputs/beats.rb", :line=\>"202", :method=\>"handle\_new\_connection"}  
{:timestamp=\>"2018-05-29T11:21:58.040000-0700", :message=\>"Beats input: waiting from new events from remote host", :peer=\>"128.32.154.165:32067", :level=\>:debug, :file=\>"logstash/inputs/beats\_support/connection\_handler.rb", :line=\>"30", :method=\>"accept"}  
{:timestamp=\>"2018-05-29T11:21:58.050000-0700", :message=\>"Beats Input: Remote connection closed", :peer=\>"128.32.154.165:32067", :exception=\>#\<Lumberjack::Beats::Connection::ConnectionClosed: Lumberjack::Beats::Connection::ConnectionClosed wrapping: Errno::ECONNRESET, Connection reset by peer - Connection reset by peer\>, :level=\>:debug, :file=\>"logstash/inputs/beats.rb", :line=\>"215", :method=\>"handle\_new\_connection"}  
{:timestamp=\>"2018-05-29T11:21:58.050000-0700", :message=\>"Beats input, out of band call for flushing the content of this connection", :peer=\>"128.32.154.165:32067", :level=\>:debug, :file=\>"logstash/inputs/beats\_support/connection\_handler.rb", :line=\>"73", :method=\>"flush"}  
{:timestamp=\>"2018-05-29T11:21:58.050000-0700", :message=\>"Beats input: clearing the connection from the known clients", :peer=\>"128.32.154.165:32067", :level=\>:debug,

When I run the normal filebeat process from the windows box I get the following:

{:timestamp=\>"2018-05-29T11:19:03.091000-0700", :message=\>"Beats inputs: accepting a new connection", :peer=\>"128.32.154.165:32037", :level=\>:debug, :file=\>"logstash/inputs/beats.rb", :line=\>"202", :method=\>"handle\_new\_connection"}  
{:timestamp=\>"2018-05-29T11:19:03.094000-0700", :message=\>"Beats input: waiting from new events from remote host", :peer=\>"128.32.154.165:32037", :level=\>:debug, :file=\>"logstash/inputs/beats\_support/connection\_handler.rb", :line=\>"30", :method=\>"accept"}  
{:timestamp=\>"2018-05-29T11:19:03.377000-0700", :message=\>"Flushing buffer at interval", :instance=\>"#\<LogStash::Outputs::ElasticSearch::Buffer:0x379d3eca @operations\_mutex=#Mutex:0x395ad649, @max\_size=500, @operations\_lock=#Java::JavaUtilConcurrentLocks::ReentrantLock:0x3d6555ba, @submit\_proc=#Proc:0x2652d6da@/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-2.5.5-java/lib/logstash/outputs/elasticsearch/common.rb:57, @logger=#\<Cabin::Channel:0x4955a4c7 @metrics=#\<Cabin::Metrics:0x5e8af0d2 @metrics\_lock=#Mutex:0x1848233d, @metrics={}, @channel=#\<Cabin::Channel:0x4955a4c7 ...\>\>, @subscriber\_lock=#Mutex:0x281cd2e8, @level=:debug, @subscribers={12322=\>#\<Cabin::Outputs::IO:0x458e5d83 @io=#\<File:/var/log/logstash/logstash.log\>, @lock=#Mutex:0x1c06dfc4\>}, @data={}\>, @last\_flush=2018-05-29 11:19:02 -0700, @flush\_interval=1, @stopping=#Concurrent::AtomicBoolean:0x5243c53e, @buffer=[], @flush\_thread=#\<Thread:0x4798a97e run\>\>", :interval=\>1, :level=\>:debug, :file=\>"logstash/outputs/elasticsearch/buffer.rb", :line=\>"90", :method=\>"interval\_flush"}  
{:timestamp=\>"2018-05-29T11:19:03.498000-0700", :message=\>"Beats input: unhandled exception", :exception=\>#\<Zlib::BufError: buffer error\>, :backtrace=\>["org/jruby/ext/zlib/ZStream.java:134:in `finish'", "org/jruby/ext/zlib/JZlibInflate.java:72:in`inflate'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-beats-2.2.7/lib/lumberjack/beats/server.rb:380:in `compressed_payload'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-beats-2.2.7/lib/lumberjack/beats/server.rb:251:in`feed'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-beats-2.2.7/lib/lumberjack/beats/server.rb:384:in `compressed_payload'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-beats-2.2.7/lib/lumberjack/beats/server.rb:251:in`feed'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-beats-2.2.7/lib/lumberjack/beats/server.rb:462:in `read_socket'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-beats-2.2.7/lib/lumberjack/beats/server.rb:442:in`run'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-beats-2.2.7/lib/logstash/inputs/beats\_support/connection\_handler.rb:33:in `accept'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-beats-2.2.7/lib/logstash/inputs/beats.rb:211:in`handle\_new\_connection'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-beats-2.2.7/lib/logstash/inputs/beats\_support/circuit\_breaker.rb:42:in `execute'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-beats-2.2.7/lib/logstash/inputs/beats.rb:211:in`handle\_new\_connection'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-beats-2.2.7/lib/logstash/inputs/beats.rb:167:in `run'"], :level=\>:error, :file=\>"logstash/inputs/beats.rb", :line=\>"223", :method=\>"handle\_new\_connection"}  
{:timestamp=\>"2018-05-29T11:19:03.499000-0700", :message=\>"Beats input, out of band call for flushing the content of this connection", :peer=\>"128.32.154.165:32037", :level=\>:debug, :file=\>"logstash/inputs/beats\_support/connection\_handler.rb", :line=\>"73", :method=\>"flush"}  
{:timestamp=\>"2018-05-29T11:19:03.499000-0700", :message=\>"Beats input: clearing the connection from the known clients", :peer=\>"128.32.154.165:32037", :level=\>:debug, :file=\>"logstash/inputs/beats.rb", :line=\>"238", :method=\>"handle\_new\_connection"}  
{:timestamp=\>"2018-05-29T11:19:04.379000-0700", :message=\>"Flushing buffer at interval", :instance=\>"#\<LogStash::Outputs::ElasticSearch::Buffer:0x379d3eca @operations\_mutex=#Mutex:0x395ad649, @max\_size=500, @operations\_lock=#Java::JavaUtilConcurrentLocks::ReentrantLock:0x3d6555ba, @submit\_proc=#Proc:0x2652d6da@/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-2.5.5-java/lib/logstash/outputs/elasticsearch/common.rb:57, @logger=#\<Cabin::Channel:0x4955a4c7 @metrics=#\<Cabin::Metrics:0x5e8af0d2 @metrics\_lock=#Mutex:0x1848233d, @metrics={}, @channel=#\<Cabin::Channel:0x4955a4c7 ...\>\>, @subscriber\_lock=#Mutex:0x281cd2e8, @level=:debug, @subscribers={12322=\>#\<Cabin::Outputs::IO:0x458e5d83 @io=#\<File:/var/log/logstash/logstash.log\>, @lock=#Mutex:0x1c06dfc4\>}, @data={}\>, @last\_flush=2018-05-29 11:19:03 -0700, @flush\_interval=1, @stopping=#Concurrent::AtomicBoolean:0x5243c53e, @buffer=[], @flush\_thread=#\<Thread:0x4798a97e run\>\>", :interval=\>1, :level=\>:debug, :file=\>"logstash/outputs/elasticsearch/buffer.rb", :line=\>"90", :method=\>"interval\_flush"}

Please advise. Thanks.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 26, 2018, 10:09pm UTC](https://discuss.elastic.co/t/filebeat-configuration-assistance/133352/4 "2018-06-26T22:09:01Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.