Logstash doesn't receive any logs from filebeat

We are getting the following error message in Filebeat

2018-07-19T18:46:18.832Z ERROR logstash/async.go:235 Failed to publish events caused by: write tcp> write: connection reset by peer
2018-07-19T18:46:19.833Z ERROR pipeline/output.go:92 Failed to publish events: write tcp> write: connection reset by peer

But the connectivity is OK.

root@95eff4da9e80:/etc/filebeat# telnet 9191
Connected to
Escape character is '^]'.
telnet> quit
Connection closed.

Here is the filebeat configuration

- type: log
  enabled: true
    - /usr/src/logs/*.json
  json.message_key: log
  json.keys_under_root: true
  json.add_error_key: true
  multiline.pattern: '^\s'
  multiline.match: after
  document_type: flow-logs
  tail_files: true

  path: ${path.config}/modules.d/*.yml
  reload.enabled: false

  index.number_of_shards: 3

  hosts: [""]

And here is the logstash configuration:

  beats {
    host  => ""
    port  => 9191
    client_inactivity_timeout => 86400

output {

    amazon_es {
      hosts  => ["<aws-es>"]
      region => "<aws-region>"
      index  => "flow-logs-%{+YYYY.MM.dd}"
      codec => "json"


/usr/share/logstash/bin/logstash-plugin list --verbose beats
logstash-input-beats (5.1.0)

How can I resolve the issue?

Have you looked in the Logstash log? It might tell you why it's closing the connections.

I don't see any error messages in logstash even with stdout or debug logging.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.