# Filebeat is not connecting logstash after the upgrade **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [September 7, 2017, 2:32pm UTC](https://discuss.elastic.co/t/filebeat-is-not-connecting-logstash-after-the-upgrade/99736 "2017-09-07T14:32:06Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![harish.g](https://avatars.discourse-cdn.com/v4/letter/h/e495f1/32.png) [@harish.g](https://discuss.elastic.co/u/harish.g)\ **Post date:** [September 7, 2017, 2:32pm UTC](https://discuss.elastic.co/t/filebeat-is-not-connecting-logstash-after-the-upgrade/99736/1 "2017-09-07T14:32:06Z")
We are using filbeat version 5.\* which is not able to connect to logstash version 5.\* after the upgrade . During the previous version of file beat 1.\* and logstash is 2.\* able to establish the connection but after the upgrade its not working . Seeing below error file beat logs 017-09-07T09:23:55-05:00 INFO Non-zero metrics in the last 30s: libbeat.logstash.call\_count.PublishEvents=1 libbeat.logstash.publish.read\_bytes=12 libbeat.logstash.publish.read\_errors=1 libbeat.logstash.publish.write\_bytes=3482 libbeat.logstash.published\_and\_acked\_events=18 libbeat.logstash.published\_but\_not\_acked\_events=1727 2017-09-07T09:24:02-05:00 ERR Connecting error publishing events (retrying): dial tcp 10.190.157.83:5044: getsockopt: connection refused 2017-09-07T09:24:18-05:00 ERR Connecting error publishing events (retrying): dial tcp 10.190.157.83:5044: getsockopt: connection refused 2017-09-07T09:24:25-05:00 INFO No non-zero metrics in the last 30s 2017-09-07T09:24:50-05:00 ERR Connecting error publishing events (retrying): dial tcp 10.190.157.83:5044: getsockopt: connection refused 2017-09-07T09:24:55-05:00 INFO No non-zero metrics in the last 30s 2017-09-07T09:25:25-05:00 INFO No non-zero metrics in the last 30s 2017-09-07T09:25:51-05:00 ERR Failed to publish events caused by: read tcp 10.160.13.245:61227-\>10.190.157.83:5044: read: connection reset by peer ![Inkedfilebeat_LI](https://us1.discourse-cdn.com/elastic/original/3X/e/a/ea4e9c2e642c9161cd890bb42a543f88f82a56c4.jpg) PFA for the filebeat configuration and no errors from the logs . Please advise on the same ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [September 8, 2017, 11:34am UTC](https://discuss.elastic.co/t/filebeat-is-not-connecting-logstash-after-the-upgrade/99736/2 "2017-09-08T11:34:43Z")
Which exact versions did you upgrade to? How many filebeat instances have you send to one Logstash instance? The `getsockopt: connection refused` message indicates Logstash potentially not running. This message indicates logstash (or the host) did close the connection while filebeat was waiting for an ACK: `2017-09-07T09:25:51-05:00 ERR Failed to publish events caused by: read tcp 10.160.13.245:61227->10.190.157.83:5044: read: connection reset by peer` ---
**Author:** ![harish.g](https://avatars.discourse-cdn.com/v4/letter/h/e495f1/32.png) [@harish.g](https://discuss.elastic.co/u/harish.g)\ **Post date:** [September 8, 2017, 11:54am UTC](https://discuss.elastic.co/t/filebeat-is-not-connecting-logstash-after-the-upgrade/99736/3 "2017-09-08T11:54:55Z")
we have upgraded our ELK version 2.2 to version 5.5\* , where as file beat is upgraded from 1.3 to version 5.\* . In other environments filebeat is able connect logstash but in production its' not happening . i don't see any errors in the logstash logs . where as logstash is running properly . May i know what corrective action need to take further on this . ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [September 8, 2017, 12:30pm UTC](https://discuss.elastic.co/t/filebeat-is-not-connecting-logstash-after-the-upgrade/99736/4 "2017-09-08T12:30:16Z")
Uhm... I guess exact version of filebeat is 5.5.0? And logstash is at version 5.5.0 as well? The second message `connection reset by peer` is not about not being able to connect. It is logstash closing the connection for whatever reason. Logstash closes idle connections. Maybe it's a problem in Logstash assuming the connection being idle, besides Logstash actually being slowed down by its processing or outputs? You can try to increase the [client\_inactivity\_timeout](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-beats.html#plugins-inputs-beats-client_inactivity_timeout) in logstash. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 6, 2017, 12:30pm UTC](https://discuss.elastic.co/t/filebeat-is-not-connecting-logstash-after-the-upgrade/99736/5 "2017-10-06T12:30:40Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.