Filebeat, Logstash connection reset by peer

[DavidDebray]

Hi everyone!

I'm new to ELK stack and have encountered a problem I can't seem to figure out...

I currently have three machines in my ELK environment :

1. syslog server (Logstash, ElasticSearch, Kibana)
2. WAPT server (sofware deployment) => filebeat version 1.3.1 (amd64)
3. GLPI server => filebeat version 6.1.1 (amd64), libbeat 6.1.1

WAPT server to Logstash works fine, but GLPI to Logstash doesn't...

"Failed to publish events caused by: read tcp glpi_ip:39200->syslog_ip:5044: read: connection reset by peer
2018-01-08T10:12:02+01:00 INFO retryer: send wait signal to consumer
2018-01-08T10:12:02+01:00 INFO   done
2018-01-08T10:12:02+01:00 ERR  Failed to publish events caused by: client is not connected"

Both clients use the same Filbeat.yml file:

filebeat:
   prospectors:
    -
      paths:
        - /var/log/syslog
        - /var/log/auth.log

      input_type: log

      document_type: syslog

   registry_file: /var/lib/filebeat/registry

output:
  logstash:
    hosts: ["172.16.1.183:5044"]
    bulk_max_size: 1024

    tls:
      certificate_authorities: ["/etc/pki/tls/certs/logstash-forwarder.crt"]
      
shipper:
  
logging:
  files:
    rotateeverybytes: 10485760 # = 10MB

And here is the Logstash configuration:

input {
  beats {
    port => 5044
    ssl => true
    ssl_certificate => "/etc/pki/tls/certs/logstash-forwarder.crt"
    ssl_key => "/etc/pki/tls/private/logstash-forwarder.key"
    # Ferme la connexion inactive au bout d'1 minute au lieu de 15 secondes
    #client_inactivity_timeout => 60
  }
}
filter {
  if [type] == "syslog" {
    grok {
      match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
      add_field => [ "received_at", "%{@timestamp}" ]
      add_field => [ "received_from", "%{host}" ]
    }
    syslog_pri { }
    date {
      match => [ "syslog_timestamp", "MMM  d HH:mm:ss", "MMM dd HH:mm:ss" ]
    }
  }
}
output {
  elasticsearch {
    hosts => ["localhost:9200"]
    sniffing => true
    manage_template => false
    index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
    document_type => "%{[@metadata][type]}"
  }
}

ELK stack versions:
logstash:
Installé : 1:6.1.1-1
Candidat : 1:6.1.1-1
Table de version :
*** 1:6.1.1-1 500
elasticsearch:
Installé : 6.1.1
Candidat : 6.1.1
Table de version :
*** 6.1.1 500
kibana:
Installé : 6.1.1
Candidat : 6.1.1
Table de version :
*** 6.1.1 500

[steffens (Steffen Siering)]

Please do not post pictures of text, but properly format textual contents using the </>-button.

Filebeat configuration has been changes in between 1.x and 5.x. e.g. tls config hsa been renamed to ssl. There might have been other changes as well, But I can't recall what changed since 1.x.

[DavidDebray]

Ok thanks.

I just upgraded Filebeat package to 6.1 version on WAPT.