# Logstash CLOSE\_WAIT and Filbe beat I/0 timeout

**URL:** https://discuss.elastic.co/t/logstash-close-wait-and-filbe-beat-i-0-timeout/118650
**Category:** Logstash
**Created:** [February 6, 2018, 1:15pm UTC](https://discuss.elastic.co/t/logstash-close-wait-and-filbe-beat-i-0-timeout/118650 "2018-02-06T13:15:40Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![oraclept](https://avatars.discourse-cdn.com/v4/letter/o/ce73a5/32.png) [@oraclept](https://discuss.elastic.co/u/oraclept)
#### Post date: [February 6, 2018, 1:15pm UTC](https://discuss.elastic.co/t/logstash-close-wait-and-filbe-beat-i-0-timeout/118650/1 "2018-02-06T13:15:40Z")

</div>

In Filebeat logs I am seeing Filebeat I/O timeout with logstash tcp connection going infinite CLOSE\_WAIT. until logstash stops processing. Dont see anything in logstashlogs.

Logstash and filebeat both are 5.4 version. Not sure what is causing the issue. It was all fine until yesterday.

**Logstash completely stops processing log messages.**

Is there any setting in Logstash beats inputs to close CLOSE\_WAIT connections ?

---

<div class="post-metadata">

### Author: ![oraclept](https://avatars.discourse-cdn.com/v4/letter/o/ce73a5/32.png) [@oraclept](https://discuss.elastic.co/u/oraclept)
#### Post date: [February 6, 2018, 1:21pm UTC](https://discuss.elastic.co/t/logstash-close-wait-and-filbe-beat-i-0-timeout/118650/2 "2018-02-06T13:21:09Z")

</div>

it worked well for year. I did not change any logstash and filebeat configuration. Not sure why I am hitting issue.  
I am using logstash-input-beats (3.1.12).  
I also see below

> <https://github.com/logstash-plugins/logstash-input-beats/pull/191/files>

  

> <https://github.com/logstash-plugins/logstash-input-beats/commit/b1afb7eb4603f2403ff6356c0b219a34dcf52a22>

Not sure if I should pull those files and see.

---

<div class="post-metadata">

### Author: ![oraclept](https://avatars.discourse-cdn.com/v4/letter/o/ce73a5/32.png) [@oraclept](https://discuss.elastic.co/u/oraclept)
#### Post date: [February 6, 2018, 10:30pm UTC](https://discuss.elastic.co/t/logstash-close-wait-and-filbe-beat-i-0-timeout/118650/3 "2018-02-06T22:30:11Z")

</div>

One of the ES index was in red state. Fixing ES index resolved close\_wait issue on logstash and I/O timeout on filebeat.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 6, 2018, 10:30pm UTC](https://discuss.elastic.co/t/logstash-close-wait-and-filbe-beat-i-0-timeout/118650/4 "2018-03-06T22:30:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.