# Filebeat failed to publish events: client is not connected

**URL:** <https://discuss.elastic.co/t/filebeat-failed-to-publish-events-client-is-not-connected/215531>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [January 17, 2020, 11:15pm UTC](https://discuss.elastic.co/t/filebeat-failed-to-publish-events-client-is-not-connected/215531 "2020-01-17T23:15:12Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![rnakam01](https://avatars.discourse-cdn.com/v4/letter/r/df705f/32.png) [@rnakam01](https://discuss.elastic.co/u/rnakam01)\
**Post date:** [January 17, 2020, 11:15pm UTC](https://discuss.elastic.co/t/filebeat-failed-to-publish-events-client-is-not-connected/215531/1 "2020-01-17T23:15:12Z")

</div>

executing sudo /opt/elkstack/filebeat/filebeat -e -c /opt/elkstack/filebeat/filebeat.yml -d "publish"

Consistently get 2020-01-17T15:07:18.857-0800 ERROR logstash/async.go:256 Failed to publish events caused by: lumberjack protocol error  
2020-01-17T15:07:18.883-0800 ERROR logstash/async.go:256 Failed to publish events caused by: client is not connected  
2020-01-17T15:07:20.011-0800 ERROR pipeline/output.go:121 Failed to publish events: client is not connected

This my logstash.conf....  
input {  
beats {  
port =\> 5044  
}  
}

output {  
elasticsearch {  
hosts =\> ["[http://uinf9815p:9300](http://uinf9815p:9300)"]  
index =\> "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"  
}  
}

---

<div class="post-metadata">

**Author:** ![rnakam01](https://avatars.discourse-cdn.com/v4/letter/r/df705f/32.png) [@rnakam01](https://discuss.elastic.co/u/rnakam01)\
**Post date:** [January 29, 2020, 11:52pm UTC](https://discuss.elastic.co/t/filebeat-failed-to-publish-events-client-is-not-connected/215531/2 "2020-01-29T23:52:15Z")

</div>

> [@rnakam01](#):
>
> sudo /opt/elkstack/filebeat/filebeat -e -c /opt/elkstack/filebeat/filebeat.yml -d "publish"

The processes are in time\_wait state  
checking the pid.....  
lsof -p 1110  
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME  
java 1110 elasticsearch cwd DIR 253,1 166 50705142 /opt/elkstack/elasticsearch-7.2.0  
java 1110 elasticsearch rtd DIR 253,0 259 64 /  
java 1110 elasticsearch txt REG 253,1 8720 134821 /opt/elkstack/elasticsearch-7.2.0/jdk/bin/java  
java 1110 elasticsearch mem REG 253,1 18739200 57983 /opt/elkstack/elasticsearch-7.2.0/jdk/lib/server/classes.jsa  
java 1110 elasticsearch mem REG 253,0 163312 4200804 /usr/lib64/ld-2.17.so  
java 1110 elasticsearch mem REG 253,4 6307937 /tmp/hsperfdata\_elasticsearch/1110 (stat: No such file or directory)  
java 1110 elasticsearch mem REG 253,1 2395 50564738 /opt/elkstack/elasticsearch-7.2.0/data/nodes/0/indices/vQrJemCKQqOX9OfaA4fAAg/0/index/\_199\_1\_Lucene80\_0.dvd  
java 1110 elasticsearch mem REG 253,1 131 50564735 /opt/elkstack/elasticsearch-7.2.0/data/nodes/0/indices/MSNuiZeKS-ueIlObrTKN9A/0/index/\_2\_1\_Lucene80\_0.dvd  
java 1110 elasticsearch mem REG 253,1 131 50564745 /opt/elkstack/elasticsearch-7.2.0/data/nodes/0/indices/MSNuiZeKS-ueIlObrTKN9A/0/index/\_3\_1\_Lucene80\_0.dvd  
java 1110 elasticsearch mem REG 253,0 90248 4214868

---

<div class="post-metadata">

**Author:** ![ropc](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ropc/32/47022_2.png) [@ropc](https://discuss.elastic.co/u/ropc)\
**Post date:** [January 30, 2020, 2:34am UTC](https://discuss.elastic.co/t/filebeat-failed-to-publish-events-client-is-not-connected/215531/3 "2020-01-30T02:34:53Z")

</div>

@rnakam01 Welcome to our community forums!

If we go back to the errors you mentioned:

```auto
2020-01-17T15:07:18.857-0800 ERROR logstash/async.go:256 Failed to publish events caused by: lumberjack protocol error
2020-01-17T15:07:18.883-0800 ERROR logstash/async.go:256 Failed to publish events caused by: client is not connected
2020-01-17T15:07:20.011-0800 ERROR pipeline/output.go:121 Failed to publish events: client is not connected

```

This indicates that Filebeat is not connected to Logstash. Can you go through the steps provided in our [troubleshooting guide](https://www.elastic.co/guide/en/beats/filebeat/current/connection-problem.html)?

I hope that helps.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 27, 2020, 2:34am UTC](https://discuss.elastic.co/t/filebeat-failed-to-publish-events-client-is-not-connected/215531/4 "2020-02-27T02:34:54Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.