# Filebeat, Logstash connection reset by peer

**URL:** <https://discuss.elastic.co/t/filebeat-logstash-connection-reset-by-peer/114479>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [January 8, 2018, 9:22am UTC](https://discuss.elastic.co/t/filebeat-logstash-connection-reset-by-peer/114479 "2018-01-08T09:22:24Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![DavidDebray](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/daviddebray/32/26388_2.png) [@DavidDebray](https://discuss.elastic.co/u/DavidDebray)\
**Post date:** [January 8, 2018, 9:22am UTC](https://discuss.elastic.co/t/filebeat-logstash-connection-reset-by-peer/114479/1 "2018-01-08T09:22:24Z")

</div>

Hi everyone!

I'm new to ELK stack and have encountered a problem I can't seem to figure out...

I currently have three machines in my ELK environment :

1. syslog server (Logstash, ElasticSearch, Kibana)
2. WAPT server (sofware deployment) =\> filebeat version 1.3.1 (amd64)
3. GLPI server =\> filebeat version 6.1.1 (amd64), libbeat 6.1.1

WAPT server to Logstash works fine, but GLPI to Logstash doesn't...

```
"Failed to publish events caused by: read tcp glpi_ip:39200->syslog_ip:5044: read: connection reset by peer
2018-01-08T10:12:02+01:00 INFO retryer: send wait signal to consumer
2018-01-08T10:12:02+01:00 INFO done
2018-01-08T10:12:02+01:00 ERR Failed to publish events caused by: client is not connected"

```

Both clients use the same Filbeat.yml file:

```
filebeat:
   prospectors:
    -
      paths:
        - /var/log/syslog
        - /var/log/auth.log

      input_type: log

      document_type: syslog

   registry_file: /var/lib/filebeat/registry

output:
  logstash:
    hosts: ["172.16.1.183:5044"]
    bulk_max_size: 1024

    tls:
      certificate_authorities: ["/etc/pki/tls/certs/logstash-forwarder.crt"]
      
shipper:
  
logging:
  files:
    rotateeverybytes: 10485760 # = 10MB

```

And here is the Logstash configuration:

```
input {
  beats {
    port => 5044
    ssl => true
    ssl_certificate => "/etc/pki/tls/certs/logstash-forwarder.crt"
    ssl_key => "/etc/pki/tls/private/logstash-forwarder.key"
    # Ferme la connexion inactive au bout d'1 minute au lieu de 15 secondes
    #client_inactivity_timeout => 60
  }
}
filter {
  if [type] == "syslog" {
    grok {
      match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
      add_field => ["received_at", "%{@timestamp}"]
      add_field => ["received_from", "%{host}"]
    }
    syslog_pri { }
    date {
      match => ["syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]
    }
  }
}
output {
  elasticsearch {
    hosts => ["localhost:9200"]
    sniffing => true
    manage_template => false
    index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
    document_type => "%{[@metadata][type]}"
  }
}

```

ELK stack versions:  
logstash:  
Installé : 1:6.1.1-1  
Candidat : 1:6.1.1-1  
Table de version :  
\*\*\* 1:6.1.1-1 500  
elasticsearch:  
Installé : 6.1.1  
Candidat : 6.1.1  
Table de version :  
\*\*\* 6.1.1 500  
kibana:  
Installé : 6.1.1  
Candidat : 6.1.1  
Table de version :  
\*\*\* 6.1.1 500

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [January 8, 2018, 4:59pm UTC](https://discuss.elastic.co/t/filebeat-logstash-connection-reset-by-peer/114479/2 "2018-01-08T16:59:20Z")

</div>

Please do not post pictures of text, but properly format textual contents using the `</>`-button.

Filebeat configuration has been changes in between 1.x and 5.x. e.g. `tls` config hsa been renamed to `ssl`. There might have been other changes as well, But I can't recall what changed since 1.x.

---

<div class="post-metadata">

**Author:** ![DavidDebray](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/daviddebray/32/26388_2.png) [@DavidDebray](https://discuss.elastic.co/u/DavidDebray)\
**Post date:** [January 9, 2018, 8:56am UTC](https://discuss.elastic.co/t/filebeat-logstash-connection-reset-by-peer/114479/3 "2018-01-09T08:56:31Z")

</div>

Ok thanks.

I just upgraded Filebeat package to 6.1 version on WAPT.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 6, 2018, 9:00am UTC](https://discuss.elastic.co/t/filebeat-logstash-connection-reset-by-peer/114479/4 "2018-02-06T09:00:08Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.