# Logstash Error Message

**URL:** <https://discuss.elastic.co/t/logstash-error-message/71597>\
**Category:** Logstash\
**Created:** [January 14, 2017, 8:18am UTC](https://discuss.elastic.co/t/logstash-error-message/71597 "2017-01-14T08:18:25Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![mhalatuituia](https://avatars.discourse-cdn.com/v4/letter/m/8c91f0/32.png) [@mhalatuituia](https://discuss.elastic.co/u/mhalatuituia)\
**Post date:** [January 14, 2017, 8:18am UTC](https://discuss.elastic.co/t/logstash-error-message/71597/1 "2017-01-14T08:18:25Z")

</div>

ERR Failed to publish events caused by: read tcp \>ELK\_SERVER\_IP:5044: read: connection reset by peer

Anyone with help really appreciate.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [January 16, 2017, 12:00am UTC](https://discuss.elastic.co/t/logstash-error-message/71597/2 "2017-01-16T00:00:47Z")

</div>

Providing more information would be helpful.

What version?  
What does your config look like?  
What does your data look like?

---

<div class="post-metadata">

**Author:** ![mhalatuituia](https://avatars.discourse-cdn.com/v4/letter/m/8c91f0/32.png) [@mhalatuituia](https://discuss.elastic.co/u/mhalatuituia)\
**Post date:** [January 16, 2017, 1:39am UTC](https://discuss.elastic.co/t/logstash-error-message/71597/3 "2017-01-16T01:39:44Z")

</div>

Hi Mark

I use version 5.1 for elasticsearch, logstash,kibana and filebeat.

Here is my config

Elasticsearch (elasticsearch.yml)

[cluster.name](http://cluster.name): Cluster1  
[node.name](http://node.name): elk\_server  
network.host: localhost  
xpack.security.enabled: false

Logstash

input {  
beats {  
port =\> 5044  
ssl =\> true  
ssl\_certificate =\> "/etc/pki/tls/certs/logstash-forwarder.crt"  
ssl\_key =\> "/etc/pki/tls/private/logstash-forwarder.key"  
}  
}  
filter {  
if [type] == "syslog" {  
grok {  
match =\> { "message" =\> "%{SYSLOGTIMESTAMP:syslog\_timestamp} %{SYSLOGHOST:syslog\_hostname} %{DATA:syslog\_program}(?:[%{POSINT:syslog\_pid}])?: %{GREEDYDATA:syslog\_message}" }  
add\_field =\> ["received\_at", "%{@timestamp}"]  
add\_field =\> ["received\_from", "%{host}"]  
add\_field =\> ["client\_ip", "%{clienthost}"]  
}  
syslog\_pri { }  
date {  
match =\> ["syslog\_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]  
}  
}  
}  
output {  
elasticsearch {  
hosts =\> ["localhost:9200"]  
manage\_template =\> false  
index =\> "%{[@metadata][beat]}-%{+YYYY.MM.dd}"  
document\_type =\> "%{[@metadata][type]}"  
}  
}

Kibana

server.port: 5601  
server.host: "localhost"  
[server.name](http://server.name): "ELK Stack Server"  
elasticsearch.url: "[http://localhost:9200](http://localhost:9200)"

Filebeat

filebeat:  
prospectors:

---

<div class="post-metadata">

**Author:** ![mhalatuituia](https://avatars.discourse-cdn.com/v4/letter/m/8c91f0/32.png) [@mhalatuituia](https://discuss.elastic.co/u/mhalatuituia)\
**Post date:** [January 16, 2017, 1:47am UTC](https://discuss.elastic.co/t/logstash-error-message/71597/4 "2017-01-16T01:47:49Z")

</div>

i think this error is disappear after i correct my filebeat config ... however i want to create a filed from my dns log message which contain client ip address from which client lookup any url ... would you able to help me or point me to anything ...been trying for few days now ...thanks in advance

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 13, 2017, 1:48am UTC](https://discuss.elastic.co/t/logstash-error-message/71597/5 "2017-02-13T01:48:15Z")

</div>

Closed on February 13, 2017, 1:48am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.