# \[Filebeat IIS\] lumberjack protocol error

**URL:** <https://discuss.elastic.co/t/filebeat-iis-lumberjack-protocol-error/175210>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [April 3, 2019, 1:37pm UTC](https://discuss.elastic.co/t/filebeat-iis-lumberjack-protocol-error/175210 "2019-04-03T13:37:32Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![nyarlath](https://avatars.discourse-cdn.com/v4/letter/n/94ad74/32.png) [@nyarlath](https://discuss.elastic.co/u/nyarlath)\
**Post date:** [April 3, 2019, 1:37pm UTC](https://discuss.elastic.co/t/filebeat-iis-lumberjack-protocol-error/175210/1 "2019-04-03T13:37:33Z")

</div>

Hello all,

I have filebeat installed on two windows 2008R2 servers with IIS 7.5.  
My filebeat log file is polluted by this kind of entries:

```
 |INFO|log/input.go:138|Configured paths: [C:\inetpub\logs\LogFiles\*\*.log]|
 |---|---|---|
 |INFO|input/input.go:114|Starting input of type: log; ID: 16099378564317141154 |
 |INFO|log/harvester.go:255|Harvester started for file: C:\inetpub\logs\LogFiles\W3SVC\u_ex190403.log|
 |INFO|pipeline/output.go:95|Connecting to backoff(async(tcp://logstash_server:5044))|
 |INFO|pipeline/output.go:105|Connection to backoff(async(tcp://logstash_server:5044)) established|
 |ERROR|logstash/async.go:256|Failed to publish events caused by: read tcp 10.0.143.10:54851-logstash_server:5044: wsarecv: An existing connection was forcibly closed by the remote host.|
 |ERROR|logstash/async.go:256|Failed to publish events caused by: client is not connected|
 |ERROR|pipeline/output.go:121|Failed to publish events: client is not connected|
 |INFO|pipeline/output.go:95|Connecting to backoff(async(tcp://logstash_server:5044))|
 |INFO|pipeline/output.go:105|Connection to backoff(async(tcp://logstash_server:5044)) established|
 |ERROR|logstash/async.go:256|Failed to publish events caused by: lumberjack protocol error|
 |ERROR|logstash/async.go:256|Failed to publish events caused by: client is not connected|
 |ERROR|pipeline/output.go:121|Failed to publish events: client is not connected|
 |INFO|pipeline/output.go:95|Connecting to backoff(async(tcp://logstash_server:5044))|
 |INFO|pipeline/output.go:105|Connection to backoff(async(tcp://logstash_server:5044)) established|
 |ERROR|logstash/async.go:256|Failed to publish events caused by: lumberjack protocol error|
 |ERROR|logstash/async.go:256|Failed to publish events caused by: client is not connected|
 |ERROR|pipeline/output.go:121|Failed to publish events: client is not connected|

```

What I don't understand is :

- Why is the harvester started for one logfile?
- Why is the client in NOT CONNECTED while the connection to backend is established?

Thanks all for your help!

---

<div class="post-metadata">

**Author:** ![yemloyeydu](https://avatars.discourse-cdn.com/v4/letter/y/9de053/32.png) [@yemloyeydu](https://discuss.elastic.co/u/yemloyeydu)\
**Post date:** [April 12, 2019, 2:19pm UTC](https://discuss.elastic.co/t/filebeat-iis-lumberjack-protocol-error/175210/2 "2019-04-12T14:19:31Z")

</div>

Are you facing the issue right after the udpdate? As that is the case for me. 😥 no solution yet!

---

<div class="post-metadata">

**Author:** ![nyarlath](https://avatars.discourse-cdn.com/v4/letter/n/94ad74/32.png) [@nyarlath](https://discuss.elastic.co/u/nyarlath)\
**Post date:** [April 16, 2019, 7:28am UTC](https://discuss.elastic.co/t/filebeat-iis-lumberjack-protocol-error/175210/3 "2019-04-16T07:28:19Z")

</div>

Hello,

No issue is solved, I had two logstash conf that used the same port (5044).  
Once i removed one of the conf, everything went back to normal.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 14, 2019, 7:28am UTC](https://discuss.elastic.co/t/filebeat-iis-lumberjack-protocol-error/175210/4 "2019-05-14T07:28:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.