# Filebeat Error Failed to publish events write tcp

**URL:** https://discuss.elastic.co/t/filebeat-error-failed-to-publish-events-write-tcp/204651
**Category:** Beats
**Tags:** filebeat
**Created:** [October 22, 2019, 1:23pm UTC](https://discuss.elastic.co/t/filebeat-error-failed-to-publish-events-write-tcp/204651 "2019-10-22T13:23:11Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Neropointer](https://avatars.discourse-cdn.com/v4/letter/n/4491bb/32.png) [@Neropointer](https://discuss.elastic.co/u/Neropointer)
#### Post date: [October 22, 2019, 1:23pm UTC](https://discuss.elastic.co/t/filebeat-error-failed-to-publish-events-write-tcp/204651/1 "2019-10-22T13:23:12Z")

</div>

I am new to the whole Elasticsearch Topic and having some starter problems. I tried to search and find a solution on this topic in the Forum but couldnt find anything that could help me with it. I hope somebody can help me with this. Its seams to be a timeout problem with logstash but eather i am to stupid or inexperienced to implement the solution properly.

Filebeat 7.1  
logstash 7.1

```
Oct 22 13:09:42 hdpkeyclo-prod1 filebeat[8963]: 2019-10-22T13:09:42.184Z INFO [monitoring] log/log.go:144 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":440
Oct 22 13:09:13 hdpkeyclo-prod1 filebeat[8963]: 2019-10-22T13:09:13.723Z INFO pipeline/output.go:105 Connection to backoff(async(tcp://hdpbss-elk:5044)) established
Oct 22 13:09:13 hdpkeyclo-prod1 filebeat[8963]: 2019-10-22T13:09:13.721Z INFO pipeline/output.go:95 Connecting to backoff(async(tcp://hdpbss-elk:5044))
Oct 22 13:09:13 hdpkeyclo-prod1 filebeat[8963]: 2019-10-22T13:09:13.721Z ERROR pipeline/output.go:121 Failed to publish events: write tcp 10.88.49.8:55516->10.88.49.40:5044: write: connection reset by peer
Oct 22 13:09:12 hdpkeyclo-prod1 filebeat[8963]: 2019-10-22T13:09:12.311Z ERROR logstash/async.go:256 Failed to publish events caused by: write tcp 10.88.49.8:55516->10.88.49.40:5044: write: connection reset by peer

#----------------------------- Logstash output --------------------------------
output.logstash:
  # The Logstash hosts
  enabled: true
  hosts: ["10.88.40.40:5044"]
  loadbalance: true
  timeout: 300
  # Optional SSL. By default is off.
  # List of root certificates for HTTPS server verifications
  #ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]

  # Certificate for SSL client authentication
  #ssl.certificate: "/etc/pki/client/cert.pem"

  # Client Certificate Key
  #ssl.key: "/etc/pki/client/cert.key"

input {
  beats {
    client_inactivity_timeout => 600
    port => 5044
    tcp_keep_alive => true
  }
}
```

---

<div class="post-metadata">

### Author: ![Neropointer](https://avatars.discourse-cdn.com/v4/letter/n/4491bb/32.png) [@Neropointer](https://discuss.elastic.co/u/Neropointer)
#### Post date: [October 23, 2019, 1:54pm UTC](https://discuss.elastic.co/t/filebeat-error-failed-to-publish-events-write-tcp/204651/2 "2019-10-23T13:54:38Z")

</div>

```
Closed because the Author of this Topic is an idiot.

input {
  beats {
    port => 5044
    client_inactivity_timeout => 84600
  }
}
```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 20, 2019, 1:54pm UTC](https://discuss.elastic.co/t/filebeat-error-failed-to-publish-events-write-tcp/204651/3 "2019-11-20T13:54:39Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
