# Filebeat -\> Logstash connection reset by peer, send fail

**URL:** <https://discuss.elastic.co/t/filebeat-logstash-connection-reset-by-peer-send-fail/82589>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [April 17, 2017, 3:10pm UTC](https://discuss.elastic.co/t/filebeat-logstash-connection-reset-by-peer-send-fail/82589 "2017-04-17T15:10:38Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![reedflinch](https://avatars.discourse-cdn.com/v4/letter/r/b782af/32.png) [@reedflinch](https://discuss.elastic.co/u/reedflinch)\
**Post date:** [April 17, 2017, 3:10pm UTC](https://discuss.elastic.co/t/filebeat-logstash-connection-reset-by-peer-send-fail/82589/1 "2017-04-17T15:10:38Z")

</div>

I recently started noticing in my Filebeat logs the following:

```auto
DBG connect
ERR Connecting error publishing events (retrying): read tcp <filebeat-host>:43318-><logstash-host>:5044: read: connection reset by peer
DBG send fail

```

I'm running Filebeat v 5.3.0 and Logstash v 5.2.0 on AWS EC2 instances on Amazon Linux. My instances running Filebeat are behind a load balancer and my Logstash instance is not behind a load balancer, and the instances are in the same VPC. Security groups are open.

`filebeat.yml`:

```auto
filebeat:
  prospectors:
    # elasticsearch logs
    - input_type: log
      paths:
        - /var/log/elasticsearch/*.log

  registry_file: /var/lib/filebeat/registry

output:
  logstash:
    hosts: ["elk-logstash:5044"]
    bulk_max_size: 4096
    timeout: 60
    ssl:
      insecure: true

logging:
  to_files: true
  files:
    path: /var/log/filebeat
    name: elk
    rotateeverybytes: 10485760 # = 10MB
    keepfiles: 7
  level: debug

```

`logstash.yml` is completely vanilla.

`/etc/logstash/conf.d/02-beats-input.conf`:

```auto
input {
  beats {
    port => 5044
    ssl => false
    include_codec_tag => false
    client_inactivity_timeout => 600
  }
}

```

I've tried modifying `client_inactivity_timeout`, `bulk_max_size`, `timeout`, and other settings. I _am_ still getting logs to Logstash/Elasticsearch from other instances with similar configs.

I do notice that upon restarting filebeat with `service filebeat restart`, filebeat logs seem to show lots of published logs before getting to the connection error:

```auto
2017-04-17T15:07:46Z DBG Publish: {
  "@timestamp": "2017-04-17T15:07:41.143Z",
  "beat": {
    "hostname": "[redacted]",
    "name": "[redacted]",
    "version": "5.3.0"
  },
  "input_type": "log",
  "message": "[redacted]",
  "offset": 24733,
  "source": "/var/log/elasticsearch/elk-staging_deprecation.log",
  "type": "log"
}
2017-04-17T15:07:46Z DBG output worker: publish 237 events
2017-04-17T15:07:46Z DBG connect
2017-04-17T15:07:46Z ERR Connecting error publishing events (retrying): read tcp 10.0.4.25:43624->10.0.2.38:5044: read: connection reset by peer
2017-04-17T15:07:46Z DBG send fail

```

I'd love any advice that could help me out!

---

<div class="post-metadata">

**Author:** ![reedflinch](https://avatars.discourse-cdn.com/v4/letter/r/b782af/32.png) [@reedflinch](https://discuss.elastic.co/u/reedflinch)\
**Post date:** [April 17, 2017, 3:35pm UTC](https://discuss.elastic.co/t/filebeat-logstash-connection-reset-by-peer-send-fail/82589/2 "2017-04-17T15:35:57Z")

</div>

UPDATE: I've found one issue: on my instances that are functioning properly, I am running Filebeat v1.3.1 😑

After downgrading from 5.3.0 to 1.3.1, logs are being shipped properly to Logstash. I still don't know what is breaking on 5.3.0.

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [April 17, 2017, 4:28pm UTC](https://discuss.elastic.co/t/filebeat-logstash-connection-reset-by-peer-send-fail/82589/3 "2017-04-17T16:28:46Z")

</div>

You have enabled SSL in Filebeat, but disabled it in Logstash. So the two cannot talk.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 15, 2017, 4:29pm UTC](https://discuss.elastic.co/t/filebeat-logstash-connection-reset-by-peer-send-fail/82589/4 "2017-05-15T16:29:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.