# High Number of TCP Resets from Logstash Beats Plugin **URL:** \ **Category:** Logstash\ **Created:** [December 12, 2018, 10:18pm UTC](https://discuss.elastic.co/t/high-number-of-tcp-resets-from-logstash-beats-plugin/160632 "2018-12-12T22:18:50Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![sparky005](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sparky005/32/38754_2.png) [@sparky005](https://discuss.elastic.co/u/sparky005)\ **Post date:** [December 12, 2018, 10:18pm UTC](https://discuss.elastic.co/t/high-number-of-tcp-resets-from-logstash-beats-plugin/160632/1 "2018-12-12T22:18:51Z")
We have a couple ec2 instances running Logstash configured behind an AWS Network Load Balancer. The Network load balancer periodically connects to each logstash listener in order to verify that it is up and running. After deploying a new logstash configuration and enabling the Beats input plugin, we noticed that the number of TCP RST packets being sent from the logstash nodes increased tenfold. It looks like the beats input plugin is closing the TCP conversation with the load balancer with a TCP RESET instead of sending a FIN (see images for comparison.) Does anybody know why this is happening? Is this a bug in the logstash beats plugin or is this expected behavior? Note that this behavior does not happen with a normal TCP listener. Bad: ![bad](https://us1.discourse-cdn.com/elastic/original/3X/3/e/3e154df52310335e3ed864c314c53f61c0835528.png) Good: ![good](https://us1.discourse-cdn.com/elastic/original/3X/7/9/7994a1ef0a7fec4de196f674fa3b4d5860829333.png) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 9, 2019, 10:18pm UTC](https://discuss.elastic.co/t/high-number-of-tcp-resets-from-logstash-beats-plugin/160632/2 "2019-01-09T22:18:52Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.