# Got error in ELK cluster of 3 nodes

**URL:** <https://discuss.elastic.co/t/got-error-in-elk-cluster-of-3-nodes/84263>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [May 2, 2017, 1:05pm UTC](https://discuss.elastic.co/t/got-error-in-elk-cluster-of-3-nodes/84263 "2017-05-02T13:05:48Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![mahesh\_cs](https://avatars.discourse-cdn.com/v4/letter/m/71c47a/32.png) [@mahesh\_cs](https://discuss.elastic.co/u/mahesh_cs)\
**Post date:** [May 2, 2017, 1:05pm UTC](https://discuss.elastic.co/t/got-error-in-elk-cluster-of-3-nodes/84263/1 "2017-05-02T13:05:49Z")

</div>

Hello,

I have 3 ubuntu server lets their name are **A** , **B** and **C**. As of now I am trying to configure for syslog.

I got the following error in filebeat log of sever **A** as :  
**ERR Connecting error publishing events (retrying): read tcp 10.10.10.20:55752\>10.10.10.21:5044: read: connection reset by peer** and on machine **B** I found this error **"[ERROR][logstash.outputs.elasticsearch] Action"** in **logstash-plain.log**

Kindly suggest the appropriate way to configure .

On sever **A** I have installed elasticsearch and filebeat, their non commented config file looks like :

**elasticsearch.yml** :  
**[cluster.name](http://cluster.name)**: syscluster  
**[node.name](http://node.name)**: es-data-01  
**node.data** : true  
**network.host** : 10.10.10.20  
**http.port** : 9200

**filebeat.yml:**  
**filebeat.prospectors:**  
**- input\_type:** log  
**paths:**  
- /var/log/auth.log  
- /var/log/syslog  
**output.elasticsearch:**  
**hosts:** ["10.10.10.21:9200"]  
**output.logstash:**  
**hosts:** ["10.10.10.21:5044"]  
**bulk\_max\_size:** 2048  
**ssl.certificate\_authorities:** ["/etc/filebeat/logstash.crt"]  
**[template.name](http://template.name):**"filebeat"  
**template.path:**"filebeat.template.json"  
**template.overwrite:** false

On server **B** I have installed elasticsearch, logstash and filebeat, their non commented config file looks like

**elasticsearch.yml:**  
**[cluster.name](http://cluster.name):** syscluster  
**[node.name](http://node.name):** es-client-01  
**node.data:** false  
**network.host:** 10.10.10.21  
**http.port:** 9200  
**discovery.zen.ping.unicast.hosts:** ["10.10.10.21", "10.10.10.20","10.10.10.22"]

**logstash,yml:**  
**path.data:** /var/lib/logstash  
**path.config:** /etc/logstash/conf.d  
**http.host:**"10.10.10.21"  
**http.port:** 9600-9700  
**path.logs:** /var/log/logstash

**filebeat.yml:**  
**filebeat.prospectors:**  
**- input\_type:** log  
**paths:**  
- /var/log/auth.log  
- /var/log/syslog  
**output.elasticsearch:**  
**hosts:** ["10.10.10.21:9200"]  
**output.logstash:**  
**hosts:** ["10.10.10.21:5044"]  
**bulk\_max\_size:** 1024

On server **C** I have installed elasticsearch only and its non commented config file looks like

**elasticsearch.yml:**  
**[cluster.name](http://cluster.name):** syscluster  
**[node.name](http://node.name):** es-master-01  
**node.master:** true  
**node.data:** false  
**network.host:** 10.10.10.22

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [May 9, 2017, 11:56am UTC](https://discuss.elastic.co/t/got-error-in-elk-cluster-of-3-nodes/84263/2 "2017-05-09T11:56:29Z")

</div>

Uhm, which filebeat is forwarding to which logstash and which logstash to elasticsearch? Can we start with one setup/use-case?

Which versions have you running?

The error messages indicates the TCP connection being closed by or on behalf of logstash? Filebeat will reconnect and send again. does the error go on?

Personally I don't recommend 2 output types by one beat, due to generating some indirect coupling between 2 downstream systems in beats. I'd rather opt having Logstash forward to other outputs. Especially with Logstash 5.4 finally GAing persistent queues support.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 6, 2017, 11:59am UTC](https://discuss.elastic.co/t/got-error-in-elk-cluster-of-3-nodes/84263/3 "2017-06-06T11:59:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.