Filebeat error failed to publish events caused connection reset by peer

Elastic Stack Beats
#1

Hello Everyone,

Need help for following error in filebeat with logstash.

error failed to publish events caused by: write tcp 127.0.0.1:random_port->127.0.0.1:5044 write: connection reset by peer

I already increased client_inactivity_timeout => 60 seconds. but still getting same error after some time.

input {
beats {
port => 5044
client_inactivity_timeout => 60
}
}

pls suggest to fix it permanently.

Thanks in advance...

#2

Hi!

Does the error gets fixed after some retries or Filebeat completely stops sending?
It should be a network issue, but Filebeat will retry to send the failed batch so you will not lose any data if it is able to recover.

C.

#3

Thanks for reply.
Filebeat is sending logs but, i continuously i can see this error. is there there any configurations will i have to make in filebeat or logstash ??

#4

Hi!

Maybe this can be of help: Publishing to Logstash fails with "connection reset by peer" message | Filebeat Reference [7.12] | Elastic

#5

Thank You Chris,
can you please suggest example or demo configuration here for ttl or anythig else to fix this issue, firewall is not a issue because filebeat and logstash is in same server.

pls let me know where i need to keep the configuration that you are sending it to me ?

Thanks in advance

#6

Hi!

It should be in the output configuration as docs indicate: Configure the Logstash output | Filebeat Reference [7.12] | Elastic

Foe example:

output.logstash:
  hosts: ["127.0.0.1:5044"]
  ttl: 120