# Getting " ERR Failed to publish events caused by: lumberjack protocol error" in Filebeat

**URL:** <https://discuss.elastic.co/t/getting-err-failed-to-publish-events-caused-by-lumberjack-protocol-error-in-filebeat/106509>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [November 6, 2017, 11:12am UTC](https://discuss.elastic.co/t/getting-err-failed-to-publish-events-caused-by-lumberjack-protocol-error-in-filebeat/106509 "2017-11-06T11:12:01Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Telstra\_Aus](https://avatars.discourse-cdn.com/v4/letter/t/958977/32.png) [@Telstra\_Aus](https://discuss.elastic.co/u/Telstra_Aus)\
**Post date:** [November 6, 2017, 11:12am UTC](https://discuss.elastic.co/t/getting-err-failed-to-publish-events-caused-by-lumberjack-protocol-error-in-filebeat/106509/1 "2017-11-06T11:12:01Z")

</div>

Hi,

I am trying to implement ELK with filebeat in some of my servers, As of now i am trying it locally.  
When ever i am trying to start the filebeat to send the logs to my logstash its throwing " ERR Failed to publish events caused by: lumberjack protocol error"

-------------Filebeat.yml------------  
filebeat.prospectors:

- input\_type: log
  - C:\Users\vineetsh\Downloads\ELK\LogStable\ELK\Logs\CRM\*

output.logstash:  
hosts: ["10.19.121.98:9600"]

--------------logstash.conf---------------------  
input {  
beats {  
type =\> beats  
port =\> 5044  
host =\> "10.19.121.98"  
}  
}

----------Fliebeat Logs---------------------------  
C:\Users\vineetsh\Downloads\ELK\LogStable\ELK\filebeat-5.6.3-linux-x86\_64\>filebeat.exe -e -c filebeat.yml  
2017/11/06 11:09:11.600876 beat.go:297: INFO Home path: [C:\Users\vineetsh\Downloads\ELK\LogStable\ELK\filebeat-5.6.3-linux-x86\_64] Config path: [C:\Users\vinee  
tsh\Downloads\ELK\LogStable\ELK\filebeat-5.6.3-linux-x86\_64] Data path: [C:\Users\vineetsh\Downloads\ELK\LogStable\ELK\filebeat-5.6.3-linux-x86\_64\data] Logs pa  
th: [C:\Users\vineetsh\Downloads\ELK\LogStable\ELK\filebeat-5.6.3-linux-x86\_64\logs]  
2017/11/06 11:09:11.600876 metrics.go:23: INFO Metrics logging every 30s  
2017/11/06 11:09:11.600876 beat.go:192: INFO Setup Beat: filebeat; Version: 5.6.3  
2017/11/06 11:09:11.600876 logstash.go:90: INFO Max Retries set to: 3  
2017/11/06 11:09:11.601376 outputs.go:108: INFO Activated logstash as output plugin.  
2017/11/06 11:09:11.601376 publish.go:300: INFO Publisher name: vineetsh02  
2017/11/06 11:09:11.604876 async.go:63: INFO Flush Interval set to: 1s  
2017/11/06 11:09:11.604876 async.go:64: INFO Max Bulk Size set to: 2048  
2017/11/06 11:09:11.605376 beat.go:233: INFO filebeat start running.  
2017/11/06 11:09:11.605376 registrar.go:68: INFO No registry file found under: C:\Users\vineetsh\Downloads\ELK\LogStable\ELK\filebeat-5.6.3-linux-x86\_64\data\re  
gistry. Creating a new registry file.  
2017/11/06 11:09:11.609376 registrar.go:106: INFO Loading registrar data from C:\Users\vineetsh\Downloads\ELK\LogStable\ELK\filebeat-5.6.3-linux-x86\_64\data\reg  
istry  
2017/11/06 11:09:11.609376 registrar.go:123: INFO States Loaded from registrar: 0  
2017/11/06 11:09:11.609876 crawler.go:38: INFO Loading Prospectors: 1  
2017/11/06 11:09:11.609876 registrar.go:236: INFO Starting Registrar  
2017/11/06 11:09:11.609876 sync.go:41: INFO Start sending events to output  
2017/11/06 11:09:11.609876 spooler.go:63: INFO Starting spooler: spool\_size: 2048; idle\_timeout: 5s  
2017/11/06 11:09:11.609876 prospector\_log.go:65: INFO Prospector with previous states loaded: 0  
2017/11/06 11:09:11.609876 prospector.go:124: INFO Starting prospector of type: log; id: 14302591776508246079  
2017/11/06 11:09:11.610376 crawler.go:58: INFO Loading and starting Prospectors completed. Enabled prospectors: 1  
2017/11/06 11:09:11.611376 log.go:91: INFO Harvester started for file: C:\Users\vineetsh\Downloads\ELK\LogStable\ELK\Logs\CRM\CRMServer\_3\_2.log  
2017/11/06 11:09:11.611876 log.go:91: INFO Harvester started for file: C:\Users\vineetsh\Downloads\ELK\LogStable\ELK\Logs\CRM\CRMServer\_1\_1.log  
2017/11/06 11:09:11.611876 log.go:91: INFO Harvester started for file: C:\Users\vineetsh\Downloads\ELK\LogStable\ELK\Logs\CRM\CRMServer\_1\_2.log  
2017/11/06 11:09:11.612376 log.go:91: INFO Harvester started for file: C:\Users\vineetsh\Downloads\ELK\LogStable\ELK\Logs\CRM\CRMServer\_2\_1.log  
2017/11/06 11:09:11.612876 log.go:91: INFO Harvester started for file: C:\Users\vineetsh\Downloads\ELK\LogStable\ELK\Logs\CRM\CRMServer\_2\_2.log  
2017/11/06 11:09:11.613876 log.go:91: INFO Harvester started for file: C:\Users\vineetsh\Downloads\ELK\LogStable\ELK\Logs\CRM\CRMServer\_3\_1.log  
2017/11/06 11:09:11.655376 sync.go:85: ERR Failed to publish events caused by: lumberjack protocol error  
2017/11/06 11:09:11.655376 single.go:91: INFO Error publishing events (retrying): lumberjack protocol error  
2017/11/06 11:09:12.660876 sync.go:85: ERR Failed to publish events caused by: lumberjack protocol error  
2017/11/06 11:09:12.661376 single.go:91: INFO Error publishing events (retrying): lumberjack protocol error  
2017/11/06 11:09:14.665376 sync.go:85: ERR Failed to publish events caused by: lumberjack protocol error  
2017/11/06 11:09:14.665376 single.go:91: INFO Error publishing events (retrying): lumberjack protocol error  
2017/11/06 11:09:18.669876 sync.go:85: ERR Failed to publish events caused by: lumberjack protocol error  
2017/11/06 11:09:18.670376 single.go:91: INFO Error publishing events (retrying): lumberjack protocol error  
2017/11/06 11:09:26.674876 sync.go:85: ERR Failed to publish events caused by: lumberjack protocol error  
2017/11/06 11:09:26.674876 single.go:91: INFO Error publishing events (retrying): lumberjack protocol error  
2017/11/06 11:09:41.597876 metrics.go:39: INFO Non-zero metrics in the last 30s: filebeat.harvester.open\_files=6 filebeat.harvester.running=6 filebeat.harvester  
.started=6 libbeat.logstash.call\_count.PublishEvents=5 libbeat.logstash.publish.read\_bytes=30 libbeat.logstash.publish.write\_bytes=2092 libbeat.logstash.publish  
ed\_but\_not\_acked\_events=10210 libbeat.publisher.published\_events=2042 registrar.writes=1  
2017/11/06 11:09:42.679376 sync.go:85: ERR Failed to publish events caused by: lumberjack protocol error  
2017/11/06 11:09:42.679876 single.go:91: INFO Error publishing events (retrying): lumberjack protocol error

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [November 6, 2017, 11:12am UTC](https://discuss.elastic.co/t/getting-err-failed-to-publish-events-caused-by-lumberjack-protocol-error-in-filebeat/106509/2 "2017-11-06T11:12:57Z")

</div>

> [@Telstra\_Aus](#):
>
> hosts: ["10.19.121.98:9600"]

This should connect to the beats input on port 5044.

---

<div class="post-metadata">

**Author:** ![Telstra\_Aus](https://avatars.discourse-cdn.com/v4/letter/t/958977/32.png) [@Telstra\_Aus](https://discuss.elastic.co/u/Telstra_Aus)\
**Post date:** [November 6, 2017, 11:14am UTC](https://discuss.elastic.co/t/getting-err-failed-to-publish-events-caused-by-lumberjack-protocol-error-in-filebeat/106509/3 "2017-11-06T11:14:30Z")

</div>

So this need to change to hosts: ["10.19.121.98:5044"] in filebeat.yml?

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [November 6, 2017, 11:21am UTC](https://discuss.elastic.co/t/getting-err-failed-to-publish-events-caused-by-lumberjack-protocol-error-in-filebeat/106509/4 "2017-11-06T11:21:18Z")

</div>

Yes.

---

<div class="post-metadata">

**Author:** ![Telstra\_Aus](https://avatars.discourse-cdn.com/v4/letter/t/958977/32.png) [@Telstra\_Aus](https://discuss.elastic.co/u/Telstra_Aus)\
**Post date:** [November 7, 2017, 4:43am UTC](https://discuss.elastic.co/t/getting-err-failed-to-publish-events-caused-by-lumberjack-protocol-error-in-filebeat/106509/5 "2017-11-07T04:43:19Z")

</div>

Thanks, it worked 😀

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 5, 2017, 4:43am UTC](https://discuss.elastic.co/t/getting-err-failed-to-publish-events-caused-by-lumberjack-protocol-error-in-filebeat/106509/6 "2017-12-05T04:43:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.