# FileBeat6.2.4 ERROR	logstash/async.go:235	Failed to publish events caused by: write tcp 192.168.1.2:19616-\>192.168.1.3:5044: write: connection reset by peer

**URL:** <https://discuss.elastic.co/t/filebeat6-2-4-error-logstash-async-go-235-failed-to-publish-events-caused-by-write-tcp-192-168-1-2-19616-192-168-1-3-write-connection-reset-by-peer/147503>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [September 6, 2018, 6:35am UTC](https://discuss.elastic.co/t/filebeat6-2-4-error-logstash-async-go-235-failed-to-publish-events-caused-by-write-tcp-192-168-1-2-19616-192-168-1-3-write-connection-reset-by-peer/147503 "2018-09-06T06:35:45Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![xiaozuo](https://avatars.discourse-cdn.com/v4/letter/x/9d8465/32.png) [@xiaozuo](https://discuss.elastic.co/u/xiaozuo)\
**Post date:** [September 6, 2018, 6:35am UTC](https://discuss.elastic.co/t/filebeat6-2-4-error-logstash-async-go-235-failed-to-publish-events-caused-by-write-tcp-192-168-1-2-19616-192-168-1-3-write-connection-reset-by-peer/147503/1 "2018-09-06T06:35:45Z")

</div>

Hello.  
I'm using the filebeat 6.2.4, but I get this error when I run filebeat, how to solve?

```
2018-09-06T14:00:09.729+0800	DEBUG	[harvester]	log/log.go:85	End of file reached: /var/log/messages; Backoff now.
2018-09-06T14:00:10.729+0800	DEBUG	[harvester]	log/log.go:85	End of file reached: /var/log/messages; Backoff now.
2018-09-06T14:00:10.730+0800	DEBUG	[transport]	transport/client.go:201	handle error: write tcp 192.168.1.2:19616->192.168.1.3:5044: write: connection reset by peer
2018-09-06T14:00:10.730+0800	DEBUG	[logstash]	logstash/async.go:142	2 events out of 2 events sent to logstash host 192.168.1.3:5044. Continue sending
2018-09-06T14:00:10.730+0800	DEBUG	[logstash]	logstash/async.go:99	close connection
2018-09-06T14:00:10.730+0800	DEBUG	[transport]	transport/client.go:114	closing
2018-09-06T14:00:10.730+0800	ERROR	logstash/async.go:235	Failed to publish events caused by: write tcp 192.168.1.2:19616->192.168.1.3:5044: write: connection reset by peer
2018-09-06T14:00:10.731+0800	DEBUG	[logstash]	logstash/async.go:99	close connection
2018-09-06T14:00:11.731+0800	ERROR	pipeline/output.go:92	Failed to publish events: write tcp 192.168.1.2:19616->192.168.1.3:5044: write: connection reset by peer
2018-09-06T14:00:11.731+0800	DEBUG	[logstash]	logstash/async.go:94	connect
2018-09-06T14:00:11.732+0800	DEBUG	[logstash]	logstash/async.go:142	2 events out of 2 events sent to logstash host 192.168.1.3:5044. Continue sending
2018-09-06T14:00:11.765+0800	DEBUG	[registrar]	registrar/registrar.go:228	Processing 2 events
2018-09-06T14:00:11.766+0800	DEBUG	[registrar]	registrar/registrar.go:200	Registrar state updates processed. Count: 2
2018-09-06T14:00:11.766+0800	DEBUG	[registrar]	registrar/registrar.go:259	Write registry file: /opt/filebeat/data/registry
2018-09-06T14:00:11.766+0800	DEBUG	[registrar]	registrar/registrar.go:284	Registry file updated. 1 states written.
2018-09-06T14:00:12.729+0800	DEBUG	[harvester]	log/log.go:85	End of file reached: /var/log/messages; Backoff now.
2018-09-06T14:00:16.729+0800	DEBUG	[harvester]	log/log.go:85	End of file reached: /var/log/messages; Backoff now.
2018-09-06T14:00:19.684+0800	DEBUG	[prospector]	prospector/prospector.go:124	Run prospector
2018-09-06T14:00:19.684+0800	DEBUG	[prospector]	log/prospector.go:147	Start next scan
2018-09-06T14:00:19.685+0800	DEBUG	[prospector]	log/prospector.go:362	Check file for harvesting: /var/log/messages
2018-09-06T14:00:19.685+0800	DEBUG	[prospector]	log/prospector.go:448	Update existing file for harvesting: /var/log/messages, offset: 134093
2018-09-06T14:00:19.685+0800	DEBUG	[prospector]	log/prospector.go:500	Harvester for file is still running: /var/log/messages
2018-09-06T14:00:19.685+0800	DEBUG	[prospector]	log/prospector.go:168	Prospector states cleaned up. Before: 1, After: 1, Pending: 0
2018-09-06T14:00:24.730+0800	DEBUG	[harvester]	log/log.go:85	End of file reached: /var/log/messages; Backoff now.
2018-09-06T14:00:29.685+0800	DEBUG	[prospector]	prospector/prospector.go:124	Run prospector
2018-09-06T14:00:29.685+0800	DEBUG	[prospector]	log/prospector.go:147	Start next scan
2018-09-06T14:00:29.685+0800	DEBUG	[prospector]	log/prospector.go:362	Check file for harvesting: /var/log/messages
2018-09-06T14:00:29.685+0800	DEBUG	[prospector]	log/prospector.go:448	Update existing file for harvesting: /var/log/messages, offset: 134093
2018-09-06T14:00:29.685+0800	DEBUG	[prospector]	log/prospector.go:500	Harvester for file is still running: /var/log/messages
2018-09-06T14:00:29.685+0800	DEBUG	[prospector]	log/prospector.go:168	Prospector states cleaned up. Before: 1, After: 1, Pending: 0
2018-09-06T14:00:34.730+0800	DEBUG	[harvester]	log/log.go:85	End of file reached: /var/log/messages; Backoff now.

```

This is the filebeat profile:

```
filebeat.prospectors:
- type: log
  enabled: true
  paths:
    - /var/log/messages

output.logstash:
  hosts: ["192.168.1.3:5044"]

logging.level: debug
logging.selectors: ["*"]

```

this is my 'ls logstash:

```
input {
    beats {
        port => 5044
    }
}
output {
    file {
        path => "message-%{+YYYY.MM.dd}/%{host}.log"
    }
}
```

---

<div class="post-metadata">

**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\
**Post date:** [September 6, 2018, 7:05am UTC](https://discuss.elastic.co/t/filebeat6-2-4-error-logstash-async-go-235-failed-to-publish-events-caused-by-write-tcp-192-168-1-2-19616-192-168-1-3-write-connection-reset-by-peer/147503/2 "2018-09-06T07:05:13Z")

</div>

What's in you LS logs?

---

<div class="post-metadata">

**Author:** ![xiaozuo](https://avatars.discourse-cdn.com/v4/letter/x/9d8465/32.png) [@xiaozuo](https://discuss.elastic.co/u/xiaozuo)\
**Post date:** [September 6, 2018, 7:18am UTC](https://discuss.elastic.co/t/filebeat6-2-4-error-logstash-async-go-235-failed-to-publish-events-caused-by-write-tcp-192-168-1-2-19616-192-168-1-3-write-connection-reset-by-peer/147503/3 "2018-09-06T07:18:49Z")

</div>

There are no logs in LS

```
[2018-09-06T13:55:48,922][INFO][logstash.modules.scaffold] Initializing module {:module_name=>"fb_apache", :directory=>"/opt/logstash/modules/fb_apache/configuration"}
[2018-09-06T13:55:48,945][INFO][logstash.modules.scaffold] Initializing module {:module_name=>"netflow", :directory=>"/opt/logstash/modules/netflow/configuration"}
[2018-09-06T13:55:49,411][WARN][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
[2018-09-06T13:55:49,994][INFO][logstash.runner] Starting Logstash {"logstash.version"=>"6.2.4"}
[2018-09-06T13:55:50,325][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=>9600}
[2018-09-06T13:55:52,072][INFO][logstash.pipeline] Starting pipeline {:pipeline_id=>"main", "pipeline.workers"=>48, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>50}
[2018-09-06T13:55:52,540][INFO][logstash.inputs.beats] Beats inputs: Starting input listener {:address=>"0.0.0.0:5044"}
[2018-09-06T13:55:52,621][INFO][logstash.pipeline] Pipeline started successfully {:pipeline_id=>"main", :thread=>"#<Thread:0x14d672ca run>"}
[2018-09-06T13:55:52,673][INFO][org.logstash.beats.Server] Starting server on port: 5044
[2018-09-06T13:55:52,704][INFO][logstash.agent] Pipelines running {:count=>1, :pipelines=>["main"]}
[2018-09-06T13:56:11,351][INFO][logstash.outputs.file] Opening file {:path=>"/opt/logstash/message-2018.09.06/nfjd-dp-hadoop00-node02.jpushoa.com.log"}
[2018-09-06T13:56:11,356][INFO][logstash.outputs.file] Creating directory {:directory=>"/opt/logstash/message-2018.09.06"}
```

---

<div class="post-metadata">

**Author:** ![xiaozuo](https://avatars.discourse-cdn.com/v4/letter/x/9d8465/32.png) [@xiaozuo](https://discuss.elastic.co/u/xiaozuo)\
**Post date:** [September 6, 2018, 7:51am UTC](https://discuss.elastic.co/t/filebeat6-2-4-error-logstash-async-go-235-failed-to-publish-events-caused-by-write-tcp-192-168-1-2-19616-192-168-1-3-write-connection-reset-by-peer/147503/4 "2018-09-06T07:51:04Z")

</div>

Hi, how to solve this problem, thank you！

---

<div class="post-metadata">

**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\
**Post date:** [September 6, 2018, 8:02am UTC](https://discuss.elastic.co/t/filebeat6-2-4-error-logstash-async-go-235-failed-to-publish-events-caused-by-write-tcp-192-168-1-2-19616-192-168-1-3-write-connection-reset-by-peer/147503/5 "2018-09-06T08:02:29Z")

</div>

Could you try updating `logstash-input-beats` plugin of LS?

```auto
bin/logstash-plugin update logstash-input-beats

```

---

<div class="post-metadata">

**Author:** ![xiaozuo](https://avatars.discourse-cdn.com/v4/letter/x/9d8465/32.png) [@xiaozuo](https://discuss.elastic.co/u/xiaozuo)\
**Post date:** [September 6, 2018, 8:18am UTC](https://discuss.elastic.co/t/filebeat6-2-4-error-logstash-async-go-235-failed-to-publish-events-caused-by-write-tcp-192-168-1-2-19616-192-168-1-3-write-connection-reset-by-peer/147503/6 "2018-09-06T08:18:50Z")

</div>

Hi, I have tried to update the logstash-input-beats plugin, but the problem still exists. This error will be reported every time I run it. It seems that the log can be collected normally

---

<div class="post-metadata">

**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\
**Post date:** [September 6, 2018, 8:22am UTC](https://discuss.elastic.co/t/filebeat6-2-4-error-logstash-async-go-235-failed-to-publish-events-caused-by-write-tcp-192-168-1-2-19616-192-168-1-3-write-connection-reset-by-peer/147503/7 "2018-09-06T08:22:24Z")

</div>

It's possible LS dropping the connection, because your Beat have been inactive for too long.

Have you tried setting `client_activity_timeout` to a bigger value in LS?  
[https://www.elastic.co/guide/en/logstash/current/plugins-inputs-beats.html#plugins-inputs-beats-client\_inactivity\_timeout](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-beats.html#plugins-inputs-beats-client_inactivity_timeout)

---

<div class="post-metadata">

**Author:** ![xiaozuo](https://avatars.discourse-cdn.com/v4/letter/x/9d8465/32.png) [@xiaozuo](https://discuss.elastic.co/u/xiaozuo)\
**Post date:** [September 6, 2018, 9:06am UTC](https://discuss.elastic.co/t/filebeat6-2-4-error-logstash-async-go-235-failed-to-publish-events-caused-by-write-tcp-192-168-1-2-19616-192-168-1-3-write-connection-reset-by-peer/147503/8 "2018-09-06T09:06:29Z")

</div>

Thank you very much. The problem was solved. I ran it for more than 20 minutes.  
I set this parameter to `client_inactivity_timeout`

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 4, 2018, 9:06am UTC](https://discuss.elastic.co/t/filebeat6-2-4-error-logstash-async-go-235-failed-to-publish-events-caused-by-write-tcp-192-168-1-2-19616-192-168-1-3-write-connection-reset-by-peer/147503/9 "2018-10-04T09:06:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.