# Filebeat error shipping logs =\> read: connection reset by peer (no TLS/SSL)
**URL:** https://discuss.elastic.co/t/filebeat-error-shipping-logs-read-connection-reset-by-peer-no-tls-ssl/79438
**Category:** Beats
**Tags:** filebeat
**Created:** [March 21, 2017, 2:41pm UTC](https://discuss.elastic.co/t/filebeat-error-shipping-logs-read-connection-reset-by-peer-no-tls-ssl/79438 "2017-03-21T14:41:14Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@zokratez](https://discuss.elastic.co/u/zokratez)
#### Post date: [March 21, 2017, 2:41pm UTC](https://discuss.elastic.co/t/filebeat-error-shipping-logs-read-connection-reset-by-peer-no-tls-ssl/79438/1 "2017-03-21T14:41:14Z")
I searched in the other topics but cannot find the solution to my problem....
**Scenary:**
FileBeat 5.2.2.1
Filebeat-input-plugin 3.1.14
ELK 5.2
I have 4 server successfully sending logs to the logstash servers... I create a new server but it's imposible to make it work...
**This is my config:**
```
filebeat.prospectors:
- input_type: log
paths:
- /var/log/maillog
document_type: maillog
- input_type: log
paths:
- /var/log/secure
document_type: maillogin
- input_type: log
paths:
- /var/log/fail2ban.log
document_type: fail2ban
output.elasticsearch:
hosts: ["host1:5044", "host2:5044"]
loadbalance: true
```
And I get the following errors...
> 2017-03-21T11:30:41-03:00 ERR Connect failed with: Get [http://host1:5044](http://host1:5044): read tcp 10.73.1.25:49879-\>10.73.2.86:5044: read: connection reset by peer
> 2017-03-21T11:30:41-03:00 ERR Connect failed with: Get [http://host2:5044](http://host2:5044): read tcp 10.73.1.25:35833-\>10.73.2.87:5044: read: connection reset by peer
> 2017-03-21T11:31:08-03:00 INFO Non-zero metrics in the last 30s: libbeat.es.publish.write\_bytes=264 libbeat.es.publish.read\_errors=2
**While the others servers say:**
> 2017-03-21T10:36:49-03:00 INFO Non-zero metrics in the last 30s: publish.events=193 libbeat.logstash.call\_count.PublishEvents=6 libbeat.logstash.publish.write\_bytes=12409 registrar.states.update=193 libbeat.logstash.publish.read\_bytes=72 libbeat.logstash.published\_and\_acked\_events=193 libbeat.publisher.published\_events=193 registrar.writes=6
1. The configs are identical... All the servers are Centos 6 or 7.
2. I'm not using TLS/SSL.
3. There is no firewall rules or SELinux enabled.
4. The logstash server dont write any log about the "Cause of rejection".
What can I do?
---
### Author:  [@zokratez](https://discuss.elastic.co/u/zokratez)
#### Post date: [March 21, 2017, 2:44pm UTC](https://discuss.elastic.co/t/filebeat-error-shipping-logs-read-connection-reset-by-peer-no-tls-ssl/79438/2 "2017-03-21T14:44:40Z")
In addition, this is the start service log in the server that doesnt work:
```
Starting filebeat: 2017/03/21 14:43:45.548574 beat.go:267: INFO Home path: [/usr/share/filebeat] Config path: [/etc/filebeat] Data path: [/var/lib/filebeat] Logs path: [/var/log/filebeat]
2017/03/21 14:43:45.548633 beat.go:177: INFO Setup Beat: filebeat; Version: 5.2.2
2017/03/21 14:43:45.548775 logp.go:219: INFO Metrics logging every 30s
2017/03/21 14:43:45.548985 output.go:167: INFO Loading template enabled. Reading template file: /etc/filebeat/filebeat.template.json
2017/03/21 14:43:45.549518 output.go:178: INFO Loading template enabled for Elasticsearch 2.x. Reading template file: /etc/filebeat/filebeat.template-es2x.json
2017/03/21 14:43:45.549986 client.go:120: INFO Elasticsearch url: http://host1:5044
2017/03/21 14:43:45.550089 client.go:120: INFO Elasticsearch url: http://host2:5044
2017/03/21 14:43:45.550414 outputs.go:106: INFO Activated elasticsearch as output plugin.
2017/03/21 14:43:45.550646 publish.go:291: INFO Publisher name: mail01.cabib.local
2017/03/21 14:43:45.550852 async.go:63: INFO Flush Interval set to: 1s
2017/03/21 14:43:45.550869 async.go:64: INFO Max Bulk Size set to: 50
Config OK
```
And this is the service log on the working one:
```
Starting filebeat: 2017/03/21 14:46:17.113994 beat.go:267: INFO Home path: [/usr/share/filebeat] Config path: [/etc/filebeat] Data path: [/var/lib/filebeat] Logs path: [/var/log/filebeat]
2017/03/21 14:46:17.114085 beat.go:177: INFO Setup Beat: filebeat; Version: 5.2.2
2017/03/21 14:46:17.114264 logstash.go:90: INFO Max Retries set to: 3
2017/03/21 14:46:17.114845 logp.go:219: INFO Metrics logging every 30s
2017/03/21 14:46:17.114913 outputs.go:106: INFO Activated logstash as output plugin.
2017/03/21 14:46:17.115075 publish.go:291: INFO Publisher name: w5.cabib.local
2017/03/21 14:46:17.115811 async.go:63: INFO Flush Interval set to: 1s
2017/03/21 14:46:17.115837 async.go:64: INFO Max Bulk Size set to: 2048
Config OK
```
Much more resumed... Why are diferents if I have installed it from the same repository?
PD: I was tryed purge and reinstall.
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [March 21, 2017, 4:00pm UTC](https://discuss.elastic.co/t/filebeat-error-shipping-logs-read-connection-reset-by-peer-no-tls-ssl/79438/3 "2017-03-21T16:00:11Z")
> [@zokratez](#):
>
> output.elasticsearch:
> hosts: ["host1:5044", "host2:5044"]
How about changing `output.elasticsearch` to `output.logstash`?
---
### Author:  [@zokratez](https://discuss.elastic.co/u/zokratez)
#### Post date: [March 21, 2017, 5:28pm UTC](https://discuss.elastic.co/t/filebeat-error-shipping-logs-read-connection-reset-by-peer-no-tls-ssl/79438/4 "2017-03-21T17:28:55Z")
Oh damm....
I'm so ashamed that I would delete this post ..
Sorry for make you waste time...
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 18, 2017, 5:28pm UTC](https://discuss.elastic.co/t/filebeat-error-shipping-logs-read-connection-reset-by-peer-no-tls-ssl/79438/5 "2017-04-18T17:28:55Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.