Filebeat failed to publish events: client is not connected

Elastic Stack Beats
1

executing sudo /opt/elkstack/filebeat/filebeat -e -c /opt/elkstack/filebeat/filebeat.yml -d "publish"

Consistently get 2020-01-17T15:07:18.857-0800 ERROR logstash/async.go:256 Failed to publish events caused by: lumberjack protocol error
2020-01-17T15:07:18.883-0800 ERROR logstash/async.go:256 Failed to publish events caused by: client is not connected
2020-01-17T15:07:20.011-0800 ERROR pipeline/output.go:121 Failed to publish events: client is not connected

This my logstash.conf....
input {
beats {
port => 5044
}
}

output {
elasticsearch {
hosts => ["http://uinf9815p:9300"]
index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
}
}

2

The processes are in time_wait state
checking the pid.....
lsof -p 1110
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
java 1110 elasticsearch cwd DIR 253,1 166 50705142 /opt/elkstack/elasticsearch-7.2.0
java 1110 elasticsearch rtd DIR 253,0 259 64 /
java 1110 elasticsearch txt REG 253,1 8720 134821 /opt/elkstack/elasticsearch-7.2.0/jdk/bin/java
java 1110 elasticsearch mem REG 253,1 18739200 57983 /opt/elkstack/elasticsearch-7.2.0/jdk/lib/server/classes.jsa
java 1110 elasticsearch mem REG 253,0 163312 4200804 /usr/lib64/ld-2.17.so
java 1110 elasticsearch mem REG 253,4 6307937 /tmp/hsperfdata_elasticsearch/1110 (stat: No such file or directory)
java 1110 elasticsearch mem REG 253,1 2395 50564738 /opt/elkstack/elasticsearch-7.2.0/data/nodes/0/indices/vQrJemCKQqOX9OfaA4fAAg/0/index/_199_1_Lucene80_0.dvd
java 1110 elasticsearch mem REG 253,1 131 50564735 /opt/elkstack/elasticsearch-7.2.0/data/nodes/0/indices/MSNuiZeKS-ueIlObrTKN9A/0/index/_2_1_Lucene80_0.dvd
java 1110 elasticsearch mem REG 253,1 131 50564745 /opt/elkstack/elasticsearch-7.2.0/data/nodes/0/indices/MSNuiZeKS-ueIlObrTKN9A/0/index/_3_1_Lucene80_0.dvd
java 1110 elasticsearch mem REG 253,0 90248 4214868

3

@rnakam01 Welcome to our community forums!

If we go back to the errors you mentioned:

2020-01-17T15:07:18.857-0800 ERROR logstash/async.go:256 Failed to publish events caused by: lumberjack protocol error
2020-01-17T15:07:18.883-0800 ERROR logstash/async.go:256 Failed to publish events caused by: client is not connected
2020-01-17T15:07:20.011-0800 ERROR pipeline/output.go:121 Failed to publish events: client is not connected

This indicates that Filebeat is not connected to Logstash. Can you go through the steps provided in our troubleshooting guide?

I hope that helps.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.