# Latest filebeat binary failing
**URL:** https://discuss.elastic.co/t/latest-filebeat-binary-failing/70001
**Category:** Beats
**Tags:** filebeat
**Created:** [December 26, 2016, 11:50am UTC](https://discuss.elastic.co/t/latest-filebeat-binary-failing/70001 "2016-12-26T11:50:04Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@Sai\_Birada](https://discuss.elastic.co/u/Sai_Birada)
#### Post date: [December 26, 2016, 11:50am UTC](https://discuss.elastic.co/t/latest-filebeat-binary-failing/70001/1 "2016-12-26T11:50:04Z")
Logs are flowing fine to logstash-2.4.1 if I am using filebeat-1.2.3 binary. However as part of upgradation when I am trying latest filebeat binary 5.1.2. Filebeat is failing with error
2016-12-26T03:42:46-08:00 DBG connect
2016-12-26T03:42:46-08:00 DBG Try to publish 2002 events to logstash with window size 1
2016-12-26T03:42:46-08:00 DBG handle error: EOF
2016-12-26T03:42:46-08:00 DBG closing
2016-12-26T03:42:46-08:00 DBG 0 events out of 2002 events sent to logstash. Continue sending
2016-12-26T03:42:46-08:00 DBG close connection
2016-12-26T03:42:46-08:00 ERR Failed to publish events caused by: EOF
2016-12-26T03:42:46-08:00 INFO Error publishing events (retrying): EOF
2016-12-26T03:42:46-08:00 DBG close connection
2016-12-26T03:42:46-08:00 DBG send fail
I looked at the version matching matrix and it says filebeat-5.1 will work with logstash-2.4.1. Error looks like a network issue, but if I use 1.2.3 binary its working good. Is there any configuration specifications required specially for the latest filebeat?.
---
### Author:  [@tudor](https://discuss.elastic.co/u/tudor)
#### Post date: [December 26, 2016, 3:01pm UTC](https://discuss.elastic.co/t/latest-filebeat-binary-failing/70001/2 "2016-12-26T15:01:38Z")
What logstash-input-beats plugin version do you have? Try to upgrade it, please.
---
### Author:  [@Sai\_Birada](https://discuss.elastic.co/u/Sai_Birada)
#### Post date: [December 27, 2016, 4:44am UTC](https://discuss.elastic.co/t/latest-filebeat-binary-failing/70001/3 "2016-12-27T04:44:06Z")
I am using logstash-2.4.1 with recent 3.1.2 logstash-input-beats plugin. I am using 5.1.2 filebeat binary. Following is my logstash config.
> input {
> beats {
> port =\> 443
> ssl =\> true
> ssl\_certificate\_authorities =\> ["/tmp/cacert\_filebeat.pem"]
> ssl\_certificate =\> "/tmp/ls-zs.pb.zscaleranalytics.net.crt"
> ssl\_key =\> "/tmp/ls-zs.pb.zscaleranalytics.net.key.pem"
> ssl\_verify\_mode =\> "force\_peer"
> }
> }
> filter {
> }
> output {
> stdout { }
> elasticsearch {
> hosts =\> ["10.10.35.66:9200"]
> index =\> "heartbeatlogs\_%{+YYYY.MM.dd}"
> }
> }
Following is my filebeat config.
> filebeat:
> prospectors:
> -
> paths:
> - /var/log/heartbeat.log
> fields:
> hostip: "10.10.35.180"
> cloudname: "[zscaler.net](http://zscaler.net)"
> document\_type: heartbeat\_Etc/GMT+0
> close\_older: 5m
> output:
> logstash:
> hosts: ["[ls-zsn.pb.zscaleranalytics.net:443](http://ls-zsn.pb.zscaleranalytics.net:443)"]
> loadbalance: true
> tls:
> certificate\_authorities: ["/sc/filebeat/certs/cacert\_logstash.pem"]
> certificate: "/sc/filebeat/certs/fbt-zsn.crt"
> certificate\_key: "/sc/filebeat/certs/fbt-zsn.key"
> logging:
> to\_syslog: false
> to\_files: true
> level: debug
> files:
> path: /sc/filebeat
> name: auditlog.log
> rotateeverybytes: 10485760
> keepfiles: 2
---
### Author:  [@Sai\_Birada](https://discuss.elastic.co/u/Sai_Birada)
#### Post date: [December 27, 2016, 6:34am UTC](https://discuss.elastic.co/t/latest-filebeat-binary-failing/70001/4 "2016-12-27T06:34:06Z")
This is a config issue. Its working fine with the following config modification
> output.logstash:
> hosts: ["[ls-zsn.pb.zscaleranalytics.net:443](http://ls-zsn.pb.zscaleranalytics.net:443)"]
> ssl.certificate\_authorities: ["/sc/filebeat/certs/cacert\_logstash.pem"]
> ssl.certificate: "/sc/filebeat/certs/fbt-zsn.crt"
> ssl.key: "/sc/filebeat/certs/fbt-zsn.key"
Thanks.
---
### Author:  [@steffens](https://discuss.elastic.co/u/steffens)
#### Post date: [December 27, 2016, 2:10pm UTC](https://discuss.elastic.co/t/latest-filebeat-binary-failing/70001/5 "2016-12-27T14:10:58Z")
I'd recommend to update the logstash-input-beats plugin to the more recent version. The 3.x plugin version is a complete rewrite and there have been some critical bug fixes since version 3.1.2.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 24, 2017, 2:11pm UTC](https://discuss.elastic.co/t/latest-filebeat-binary-failing/70001/6 "2017-01-24T14:11:12Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.