Filebeat output to logstash potential bug report

Elastic Stack Beats
1

Hi,I am using filebeat to send logs to logstash,if there is something wrong with the network,logstash will reset the connection,filebeat will reconnect but it will not send logs to logstash anymore.Here are the steps to reproduce this problem.

OS:RedHat AS6.8 64bit
Filebeat version: 5.4.0
Logstash version:5.3.0

Step 1. let filebeat 10.1.1.1 connects to logstash 10.1.1.2 and filebeat works normally.

Step 2. At filebeat host,type in: iptables -I INPUT -s 10.1.1.1 -p tcp -j REJECT --reject-with tcp-reset
,the connection will be reset and filebeat will try reconnect again and again,but none will succeed.

After 10 minutes or so....

Step 3. At filebeat host,type in: iptables -F to clear the rules, filebeat will reconnect to logstash,but no logs will be sent.

2

What version of the logstash beats plugin do you have?

Could you share youre filebeat and logstash logs? Also the config files?

3

@wq_Huang did you try with logstash 5.4 as well (using a newer beats input plugin). How do yu determine events being send or not send? Which output are you using in logstash?

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.