We have a couple ec2 instances running Logstash configured behind an AWS Network Load Balancer. The Network load balancer periodically connects to each logstash listener in order to verify that it is up and running. After deploying a new logstash configuration and enabling the Beats input plugin, we noticed that the number of TCP RST packets being sent from the logstash nodes increased tenfold.
It looks like the beats input plugin is closing the TCP conversation with the load balancer with a TCP RESET instead of sending a FIN (see images for comparison.)
Does anybody know why this is happening? Is this a bug in the logstash beats plugin or is this expected behavior? Note that this behavior does not happen with a normal TCP listener.
Bad:
Good:
