Log level of "ERR Failed to publish events caused by: EOF"

Elastic Stack Beats
1

Hi,

We run a custom beat based on libbeat to stream logs to logstash and see a lot of log messages like "ERR Failed to publish events caused by: EOF" in the beat's output. I know that these messages occur when a client tries to write a message on a closed TCP connection and that libbeat retries in that case. What I'm wondering is whether this message really needs to cause an ERR log line or whether we could reduce the level. IMO a message should only be an ERR if there is actually something wrong that I need to take care of.

What do you guys think?

Thanks,
Paul

2

libbeat does not retry forever and might drop events (unless you're using the Guaranteed Flag on publish). libbeat can not really tell why the connection failed, but will decrease the events live counter.
In a many occasions, it's indeed critical, as user can not send events at all. One has to distinguish between ignore error and ups, bad error (can never send or data loss)

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.