Logstash elastic_agent input: connection resets

Elastic Stack Logstash
1

I notice a lot of java.net.SocketException: Connection reset warnings in my Logstash logs. It seems this is related to the elastic_agent input and is noticeably higher in combination with Defend. It also occurs on devices where there is no firewall or load balancer between the device and the logstash server. Is this a known issue or does anyone have any ideas how to fix this?

Best regards

Christophe

2

Hello, you can check network connectivity between the Elastic Agent and Logstash using Telnet. If the connection is established, the network path between the two components is may working fine.

And Regarding client_inactivity_timeout (default: 60s) option, If the agent sends no data within that time period, Logstash will close the connection. So if you observe the connection being dropped after ~60 seconds of inactivity, it likely indicates that the agent is not producing or sending data.

In that case, you can check whether the agent is actually working by:

  • Confirming the agent process is running: ps aux | grep elastic-agent
  • Reviewing Elastic Agent logs for errors or restart loops
  • Ensuring the agent policy and output configuration correctly point to Logstash (host/port)