# Filebeat Error publishing events (retrying): EOF **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [June 21, 2016, 11:11am UTC](https://discuss.elastic.co/t/filebeat-error-publishing-events-retrying-eof/53484 "2016-06-21T11:11:59Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![sunilmchaudhari](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sunilmchaudhari/32/9475_2.png) [@sunilmchaudhari](https://discuss.elastic.co/u/sunilmchaudhari)\ **Post date:** [June 21, 2016, 11:11am UTC](https://discuss.elastic.co/t/filebeat-error-publishing-events-retrying-eof/53484/1 "2016-06-21T11:11:59Z")
Hi, I am getitng below logs in filebeat log file. ``` 2016-06-21T14:04:31+03:00 DBG Not harvesting, file didn't change: /opt/apache-tomee-jaxrs-1.6.0/logs/localhost_access_log.2016-06-17.txt 2016-06-21T14:04:31+03:00 DBG Check file for harvesting: /opt/apache-tomee-jaxrs-1.6.0/logs/localhost_access_log.2016-06-18.txt 2016-06-21T14:04:31+03:00 DBG Update existing file for harvesting: /opt/apache-tomee-jaxrs-1.6.0/logs/localhost_access_log.2016-06-18.txt 2016-06-21T14:04:31+03:00 DBG Not harvesting, file didn't change: /opt/apache-tomee-jaxrs-1.6.0/logs/localhost_access_log.2016-06-18.txt 2016-06-21T14:04:31+03:00 DBG Check file for harvesting: /opt/apache-tomee-jaxrs-1.6.0/logs/localhost_access_log.2016-06-20.txt 2016-06-21T14:04:31+03:00 DBG Update existing file for harvesting: /opt/apache-tomee-jaxrs-1.6.0/logs/localhost_access_log.2016-06-20.txt 2016-06-21T14:04:31+03:00 DBG Not harvesting, file didn't change: /opt/apache-tomee-jaxrs-1.6.0/logs/localhost_access_log.2016-06-20.txt 2016-06-21T14:04:31+03:00 DBG Check file for harvesting: /opt/apache-tomee-jaxrs-1.6.0/logs/localhost_access_log.2016-06-21.txt 2016-06-21T14:04:31+03:00 DBG Update existing file for harvesting: /opt/apache-tomee-jaxrs-1.6.0/logs/localhost_access_log.2016-06-21.txt 2016-06-21T14:04:31+03:00 DBG Not harvesting, file didn't change: /opt/apache-tomee-jaxrs-1.6.0/logs/localhost_access_log.2016-06-21.txt 2016-06-21T14:04:35+03:00 DBG connect 2016-06-21T14:04:35+03:00 DBG Try to publish 2048 events to logstash with window size 1 2016-06-21T14:04:35+03:00 DBG close connection 2016-06-21T14:04:35+03:00 DBG 0 events out of 2048 events sent to logstash. Continue sending ... 2016-06-21T14:04:35+03:00 INFO Error publishing events (retrying): EOF 2016-06-21T14:04:35+03:00 INFO send fail 2016-06-21T14:04:35+03:00 INFO backoff retry: 1m0s 2016-06-21T14:04:36+03:00 DBG End of file reached: /opt/apache-tomee-jaxrs-1.6.0/logs/localhost_access_log.2016-06-18.txt; Backoff now. 2016-06-21T14:04:36+03:00 DBG full line read 2016-06-21T14:04:37+03:00 DBG full line read 2016-06-21T14:04:41+03:00 DBG Start next scan 2016-06-21T14:04:41+03:00 DBG scan path /var/log/crm/crmERROR.log 2016-06-21T14:04:41+03:00 DBG Check file for harvesting: /var/log/crm/crmERROR.log 2016-06-21T14:04:41+03:00 DBG Update existing file for harvesting: /var/log/crm/crmERROR.log 2016-06-21T14:04:41+03:00 DBG Not harvesting, file didn't change: /var/log/crm/crmERROR.log 2016-06-21T14:04:41+03:00 DBG Start next scan ``` Log level is debug. However, I am not able to understand whats the problem? br, Sunil ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [June 21, 2016, 11:37am UTC](https://discuss.elastic.co/t/filebeat-error-publishing-events-retrying-eof/53484/2 "2016-06-21T11:37:32Z")
Have you checked logstash logs? Seems like logstash is closing the connection. ---
**Author:** ![sunilmchaudhari](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sunilmchaudhari/32/9475_2.png) [@sunilmchaudhari](https://discuss.elastic.co/u/sunilmchaudhari)\ **Post date:** [June 22, 2016, 5:07am UTC](https://discuss.elastic.co/t/filebeat-error-publishing-events-retrying-eof/53484/3 "2016-06-22T05:07:47Z")
Hi, There is connection closed by logstash. BUt what might be the reason. There are other clients connected successfully to logstash but only problem with 2 clients. :timestamp=\>"2016-06-22T08:03:42.700000+0300", :message=\>"Beats Input: Remote connection closed", :peer=\>"\< **_client-IP_** \>:58861", :exception=\>#\, :level=\>:warn} ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [June 22, 2016, 3:46pm UTC](https://discuss.elastic.co/t/filebeat-error-publishing-events-retrying-eof/53484/4 "2016-06-22T15:46:35Z")
This complete log message? Any other messages before? Not sure why it's closed. Error message in logstash is suggestive at beat ☹ . Either connection has been closed by logstash (for whatever reason) or some device (e.g. OS/firewall ) in between is closing the connection. Having reached backoff of 1minute + window size of 1 is an indicate filebeat not being able to talk to logstash for quite some time. ---
**Author:** ![sunilmchaudhari](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sunilmchaudhari/32/9475_2.png) [@sunilmchaudhari](https://discuss.elastic.co/u/sunilmchaudhari)\ **Post date:** [June 23, 2016, 6:41am UTC](https://discuss.elastic.co/t/filebeat-error-publishing-events-retrying-eof/53484/5 "2016-06-23T06:41:39Z")
Thanks all for the respsonse. I got this working fine. Root cause: It was TLS option disabled in filebeat configuration and SSL=\> true in logstash input beats. I enabled TLS option in filebeat conf and its connected. thanks Sunil Chaudhari ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 12, 2016, 11:11am UTC](https://discuss.elastic.co/t/filebeat-error-publishing-events-retrying-eof/53484/6 "2016-07-12T11:11:59Z")
This topic was automatically closed after 21 days. New replies are no longer allowed.