Filebeat -> Logstash :connection reset by peer

[yeruvass (sundar)]

I'm shipping logs from filebeat to logstash with tls and getting below error and tried lot of ways to resolve but helpless.

2017-07-21T18:24:27+05:30 ERR Failed to publish events caused by: read tcp 10.197.53.179:41349->10.197.53.179:5044: read: connection reset by peer
2017-07-21T18:24:27+05:30 INFO Error publishing events (retrying): read tcp 10.197.53.179:41349->10.197.53.179:5044: read: connection reset by peer

Filebeat and logstash versions :- 5.2.1
filebeat configurations :-
logstash:
hosts: ["10.197.53.179:5044"]
tls:
certificate_authorities: ["/etc/filebeat/logstash-fwd.crt"]

Logstash configuration :-
input {
beats {
port => 5044
ssl => true
ssl_certificate => "/etc/logstash/conf.d/logstash-fwd.crt"
ssl_key => "/etc/logstash/conf.d/logstash-fwd.key"
}
}

certificates created by using below command :

openssl req -x509 -batch -nodes -newkey rsa:2048 -keyout logstash-fwd.key -out logstash-fwd.crt -subj /CN=10.197.53.179

Please help me on this issue.

[steffens (Steffen Siering)]

Problem is most likely caused by logstash prematurely closing the connection. I think the logstash-input-beats plugin version 3.11 did mostly solve the issue. Try upgrading logstash to 5.4 and increase client_connectivity_timeout in logstash beats input.