# FILEBEAT-\> (SSL) Logstash :: Error publishing events (retrying): read tcp : i/o timeout

**URL:** <https://discuss.elastic.co/t/filebeat-ssl-logstash-error-publishing-events-retrying-read-tcp-i-o-timeout/106948>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [November 9, 2017, 12:14am UTC](https://discuss.elastic.co/t/filebeat-ssl-logstash-error-publishing-events-retrying-read-tcp-i-o-timeout/106948 "2017-11-09T00:14:06Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![lookcrabs](https://avatars.discourse-cdn.com/v4/letter/l/3ec8ea/32.png) [@lookcrabs](https://discuss.elastic.co/u/lookcrabs)\
**Post date:** [November 9, 2017, 12:14am UTC](https://discuss.elastic.co/t/filebeat-ssl-logstash-error-publishing-events-retrying-read-tcp-i-o-timeout/106948/1 "2017-11-09T00:14:06Z")

</div>

I have filebeat version 5.5.1 (ssl)-\> logstash version 5.5.1 talking to elasticsearch. I have 2 prospectors defined but only authlog seems to be sending. I have tried increasing and decreasing the bulk\_max\_size, using compression, and setting "greedydata" as my grok match. None of this seems to work.

I continually get the following errors:

2017-09-28T22:59:35Z ERR Connecting error publishing events (retrying): read tcp 172.21.16.195:56310-\>10.64.0.99:5044: i/o timeout

here is my filebeat config:

```
filebeat:
prospectors:
-
  paths:
    - /var/log/auth.log
  input_type: log
  document_type: authlog
  ignore_older: 24h
  scan_frequency: 10s
  backoff: 1s
  max_backoff: 10s
  backoff_factor: 2
  force_close_files: false
  fields_under_root: false
  close_older: 1h

-
  paths:
    - /mnt/es/log/*indexing*.log
  input_type: log
  document_type: es-indexing-log
  ignore_older: 24h
  scan_frequency: 10s
  backoff: 1s
  max_backoff: 10s
  backoff_factor: 2
  force_close_files: false
  fields_under_root: false
  close_older: 1h
  tags: ["es-indexing-log"]

registry_file: /var/lib/filebeat/registry

output:
  tags: ["elasticsearch", "prod", "green"]
  logstash:
    bulk_max_size: 1024
    hosts: ["10.64.0.99:5044"]
    worker: 1
    loadbalance: true
    timeout: 40
    ssl.certificate_authorities: ["/etc/ssl/certs/logstash-forwarder.crt"]

shipper:

logging:
  files:
    rotateeverybytes: 10485760 # = 10M

```

Here is my logstash input section for beats:

```
input {
beats {
port => 5044
ssl => true
ssl_certificate => "/etc/pki/tls/certs/logstash-forwarder.crt"
ssl_key => "/etc/pki/tls/private/logstash-forwarder.key"
}
}

```

I read that it may be my grok filter so I have changed it to just %{GREEDYDATA} . but still no luck. In any case here is my slow filter:

```
filter {
if [type] == "es-search-log" {
mutate {
add_tag => ["elasticsearch"]
}
grok {
match => { "message" => "%{GREEDYDATA}"}
}
date {
match => ["timestamp", "dd/MMM/yyyy:HH:mm:ss Z"]
}
}
}
```

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [November 9, 2017, 4:37am UTC](https://discuss.elastic.co/t/filebeat-ssl-logstash-error-publishing-events-retrying-read-tcp-i-o-timeout/106948/2 "2017-11-09T04:37:46Z")

</div>

What happens if you remove the filter completely? Could you check if something shows up in the LS logs?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 7, 2017, 4:38am UTC](https://discuss.elastic.co/t/filebeat-ssl-logstash-error-publishing-events-retrying-read-tcp-i-o-timeout/106948/3 "2017-12-07T04:38:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.