# Filebeat to Logstash ERROR, wsasend, wsarecv

**URL:** <https://discuss.elastic.co/t/filebeat-to-logstash-error-wsasend-wsarecv/73363>\
**Category:** Logstash\
**Created:** [January 31, 2017, 12:40pm UTC](https://discuss.elastic.co/t/filebeat-to-logstash-error-wsasend-wsarecv/73363 "2017-01-31T12:40:24Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![loutocky](https://avatars.discourse-cdn.com/v4/letter/l/6f9a4e/32.png) [@loutocky](https://discuss.elastic.co/u/loutocky)\
**Post date:** [January 31, 2017, 12:40pm UTC](https://discuss.elastic.co/t/filebeat-to-logstash-error-wsasend-wsarecv/73363/1 "2017-01-31T12:40:24Z")

</div>

Hi,

I am using ELK stack version 5.1.2 and I have problem with sending logs from one worker (node) to central server. Everything I configured on localhost and it worked perfectly, but on development environment not. On localhost I used SSL, but now I turned it off. So my conf file of filebeat is:

```
filebeat.prospectors:
- input_type: log

paths:
    - e:\logs\*.log

document_type: xxx_log

output.logstash:
  hosts: ["xxxx:5043"]

logging.level: error
logging.to_syslog: true

logging.files:
  rotateeverybytes: 10485760 # = 10MB

```

Logstash configuration:

```
input {
    beats {
        port => "5043"
    }
}
filter {
	if [type] == "xxx_log" {     
        multiline {
            pattern => "^TID"
            negate => true
            what => "previous"
            }
        grok {
            break_on_match => false
            match => ["message", "TID: \[%{TIMESTAMP_ISO8601:timestamp}\] %{LOGLEVEL:level} \[%{JAVACLASS:java_class}\] \(%{GREEDYDATA:thread}\) - (?<log_message>(.|\r|\n)*)"]
        }
    }
}
output {
    elasticsearch {
        hosts => ["localhost:9200"]
		user => "elastic"
		password => "changeme"
		index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
    }
}

```

Ok, when I add line to log file, for example:  
TID: [2017-01-19 13:37:18] INFO [App.java] (main) - Info test...

Filebeat starts to collect data, after successfull harvest I am getting:

`ERR Failed to publish events caused by: write tcp yyyy:51992->xxxx:5043: wsasend: An existing connection was forcibly closed by the remote host.`

Nothing in log of Logstash.

Firewall is turned off, when I open telnet from WORK node on port 5043 message will come to central server because Logstash say in log file, that I send invalid frame type, for example I send only some POST to test if port 5043 is open. So the port is open, but the elastic is empty. Sometimes, I do not know why, I am getting error in Filebeat log:

`wsarecv: An existing connection was forcibly closed by the remote host.`  
This line generates Logstash log:

```
11:45:31.094 [nioEventLoopGroup-4-2] ERROR org.logstash.beats.BeatsHandler - Exception: org.logstash.beats.BeatsParser$InvalidFrameProtocolException: Invalid Frame Type, received: 83
13:31:43.139 [nioEventLoopGroup-4-4] ERROR org.logstash.beats.BeatsHandler - Exception: An existing connection was forcibly closed by the remote host

```

Thank you for any advice.  
Jaroslav

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 28, 2017, 12:40pm UTC](https://discuss.elastic.co/t/filebeat-to-logstash-error-wsasend-wsarecv/73363/2 "2017-02-28T12:40:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.