Filebeat to logstash: Failed to publish events caused by: read tcp 192.168.155.177:55376->47.102.46.68:5045:wsarecv:An existing connection was forcibly closed by the remote host

As I said above, the above bug appears on several computers, but is normal on others.

Even logstash only have input and output. The above bug still appears on several computers.

Is it possible that the Filebeat instances sending to Logstash are inactive and Logstash closes the connections? You could try setting client_inactivity_timeout for beats in your Logstash configuration to increase the timeout before Logstash closes the connection.

I am try setting client_inactivity_timeout for beats in your Logstash configuration to increase the timeout before Logstash closes the connection.
Those computers still have the same bugs when the logs are over 100.
The computer system is win10.
This bug will only appear on a few computers, other computers are normal.
I don't know why. please help me

Also, if filebeat uploads data directly to elasticsearch, it can be uploaded as normal.There are no bugs

After investigation, we found that the network permissions of those computers were set by our network information office, which led to the above “bugs”. Thank you very much for your advice and help.

What "network permissions" exactly?

My colleagues in the network information office did not specify, but I think it maybe be restricted to network flow on some ip.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.