# Io timeout using filebeat and logstash **URL:** \ **Category:** Logstash\ **Created:** [October 3, 2017, 9:09am UTC](https://discuss.elastic.co/t/io-timeout-using-filebeat-and-logstash/102535 "2017-10-03T09:09:36Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![lishunan246](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lishunan246/32/22724_2.png) [@lishunan246](https://discuss.elastic.co/u/lishunan246)\ **Post date:** [October 3, 2017, 9:09am UTC](https://discuss.elastic.co/t/io-timeout-using-filebeat-and-logstash/102535/1 "2017-10-03T09:09:37Z")
I am using filebeat 5.5.1 and logstash 5.5.1 on Debian 8 to collect logs and send them to InfluxDB. Logstash and filebeat are installed as a whole on 20 servers forwarding logs to a single InfluxDB server. Logstash-input-beat logstash-output-influxdb and some filter plugins written by myself are used. They will work fine for a long time , after one month or so things will go wrong. Logstash writes no warning or error logs. Filebeat log goes like this: ``` 2017-10-03T16:31:17+08:00 INFO Non-zero metrics in the last 30s: libbeat.logstash.publish.read_errors=1 libbeat.logstash.published_but_not_acked_events=4096 2017-10-03T16:31:47+08:00 INFO No non-zero metrics in the last 30s 2017-10-03T16:32:17+08:00 INFO Non-zero metrics in the last 30s: libbeat.logstash.call_count.PublishEvents=1 libbeat.logstash.publish.write_bytes=774 2017-10-03T16:32:19+08:00 ERR Failed to publish events caused by: read tcp 127.0.0.1:28184->127.0.0.1:5044: i/o timeout 2017-10-03T16:32:19+08:00 INFO Error publishing events (retrying): read tcp 127.0.0.1:28184->127.0.0.1:5044: i/o timeout 2017-10-03T16:32:47+08:00 INFO Non-zero metrics in the last 30s: libbeat.logstash.publish.read_errors=1 libbeat.logstash.published_but_not_acked_events=4096 2017-10-03T16:33:17+08:00 INFO No non-zero metrics in the last 30s 2017-10-03T16:33:47+08:00 INFO Non-zero metrics in the last 30s: libbeat.logstash.call_count.PublishEvents=1 libbeat.logstash.publish.write_bytes=769 2017-10-03T16:33:49+08:00 ERR Failed to publish events caused by: read tcp 127.0.0.1:28240->127.0.0.1:5044: i/o timeout 2017-10-03T16:33:49+08:00 INFO Error publishing events (retrying): read tcp 127.0.0.1:28240->127.0.0.1:5044: i/o timeout 2017-10-03T16:34:17+08:00 INFO Non-zero metrics in the last 30s: libbeat.logstash.publish.read_errors=1 libbeat.logstash.published_but_not_acked_events=4096 ``` I set the jvm heap size to 4gb for logstash. The gcutil and top of logstash is like: ``` S0 S1 E O M CCS YGC YGCT FGC FGCT GCT 0.00 2.72 33.98 29.74 91.43 85.72 249381 5888.720 82 4.375 5893.095 PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 48725 root 20 0 22.159g 4.265g 8116 S 2.7 3.4 20702:43 java ``` Restart filebeat won't solve the problem. SIGTERM can't stop logstash. So I have to use SIGKILL and then restart logstash. After this things can work for several weeks but will eventually go wrong again. Does someone have any idea about what is wrong? Is the heap size too small or is there memory leak somewhere ? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 31, 2017, 9:10am UTC](https://discuss.elastic.co/t/io-timeout-using-filebeat-and-logstash/102535/2 "2017-10-31T09:10:10Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.