(.|\r|\n)*)"
overwrite => ["message"]
}
}
if ([clone_type] != "wap" and [tiempo]) {
mutate {
remove_field => ["message"]
}
}
if ([clone_type] != "wap" and [accion]) {
mutate {
replace => { "log_type" => "rendimientocbs" }
remove_field => ["message"]
}
}
if ([clone_type] != "wap" and [producto]) {
mutate {
replace => { "log_type" => "rendimiento" }
remove_field => ["message"]
}
}
if ([clone_type] != "wap" and [cola]) {
mutate {
replace => { "log_type" => "rabbit_message" }
remove_field => ["message"]
}
}
if ([clone_type] != "wap" and [paquete] and ![mensaje_rabbit]) {
mutate {
replace => { "log_type" => "packages" }
remove_field => ["message"]
}
}
if ([clone_type] != "wap" and [acreditacion]) {
mutate {
replace => { "log_type" => "acreditacion" }
remove_field => ["message"]
}
}
if ([clone_type] != "wap" and [offer_id]) {
mutate {
replace => { "log_type" => "rendimiento_cbs" }
remove_field => ["message"]
}
}
if ([clone_type] != "wap" and [metodo]) {
mutate {
replace => { "log_type" => "rendimiento" }
remove_field => ["message"]
}
}
mutate {
convert => {
"accion" => "string"
"acreditacion" => "integer"
"celular" => "integer"
"cola" => "string"
"exchange" => "string"
"fecha_hora" => "integer"
"http_verb" => "string"
"id_transaccion" => "integer"
"interfaz" => "integer"
"mensaje_rabbit" => "string"
"metodo" => "string"
"numero_celular" => "string"
"offer_id" => "string"
"paquete" => "string"
"producto" => "string"
"regla" => "string"
"resultado" => "integer"
"ruta" => "string"
"solicitante" => "string"
"tiempo" => "integer"
"tipo_paquete" => "string"
}
}
}
}
```
---
### Author:  [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [February 19, 2026, 12:16am UTC](https://discuss.elastic.co/t/logstash-filebeat-lag-issue-logs-delayed-by-hours/385101/10 "2026-02-19T00:16:51Z")
> [@Cesar\_Mejia](#):
>
> I am seeing logs arriving now (@timestamp) that correspond to events from 2+ hours ago, this confirms that Filebeat is currently reading lines from the log files that were written hours ago, meaning it is working through a backlog accumulated during the previous bottleneck.
Can 2h difference be related to the different time zone? Not sure where servers are deployed.
Have you checked FB logs? Any trace there?
Have you try an investigation for 1-2 source on FB side?
Why is so many settings close\_ in filebeat.yml?
In general, FB is much simpler than LS, it reads lines and not much a processing logic in the most cases. Shouldn't be lags.
---
### Author:  [@Cesar\_Mejia](https://discuss.elastic.co/u/Cesar_Mejia)
#### Post date: [February 19, 2026, 12:44am UTC](https://discuss.elastic.co/t/logstash-filebeat-lag-issue-logs-delayed-by-hours/385101/11 "2026-02-19T00:44:42Z")
> [@Rios](#):
>
> Have you checked FB logs? Any trace there?
Both servers are in the same zone, the problem is some logs from the same server are arriving late
> [@Rios](#):
>
> Have you try an investigation for 1-2 source on FB side?
I am seeing repeated connection reset by peer errors pointing to the Logstash ports (4001, 4002)
```auto
2026-02-18T18:37:37.458-0600 ERROR [logstash] logstash/async.go:280 Failed to publish events caused by: write tcp IP:PORT->LOGSTASHIP:4001: write: connection reset by peer
2026-02-18T18:37:37.458-0600 INFO [publisher] pipeline/retry.go:219 retryer: send unwait signal to consumer
2026-02-18T18:37:37.458-0600 INFO [publisher] pipeline/retry.go:223 done
2026-02-18T18:37:37.463-0600 ERROR [logstash] logstash/async.go:280 Failed to publish events caused by: write tcp IP:PORT->LOGSTASHIP:4002: write: connection reset by peer
2026-02-18T18:37:37.463-0600 INFO [publisher] pipeline/retry.go:219 retryer: send unwait signal to consumer
2026-02-18T18:37:37.463-0600 INFO [publisher] pipeline/retry.go:223 done
2026-02-18T18:37:38.949-0600 ERROR [publisher_pipeline_output] pipeline/output.go:180 failed to publish events: write tcp IP:PORT->LOGSTASHIP:4001: write: connection reset by peer
```
> [@Rios](#):
>
> Why is so many settings close\_ in filebeat.yml?
Cause what i am monitoring rotates logs very frecuently under pressure and generates a massive volume
---
### Author:  [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [February 19, 2026, 1:34am UTC](https://discuss.elastic.co/t/logstash-filebeat-lag-issue-logs-delayed-by-hours/385101/12 "2026-02-19T01:34:21Z")
There was a similar problem, check [this topic](https://discuss.elastic.co/t/filebeat-clients-unable-to-publish-events-to-logstash/378592).
Most likely you have network issues, not just the lag like FB processing speed.
As Leandro Jedi said, remove `stdin` and `stdout`, especially debug because it consumes a lot of resources.
Since you are using different version, make sure to us the same version or at least upgrade FB. This is not mandatory, of course.
> Since I have a high volume of logs and a single Logstash instance with many cores, I configured multiple listeners to avoid a single TCP thread bottleneck at the input stage
Why don't you use LS pipelines? Separate .conf files. Maybe even you can use much faster the dissect parser filter in some cases.
---
### Author:  [@Cesar\_Mejia](https://discuss.elastic.co/u/Cesar_Mejia)
#### Post date: [February 19, 2026, 2:36am UTC](https://discuss.elastic.co/t/logstash-filebeat-lag-issue-logs-delayed-by-hours/385101/13 "2026-02-19T02:36:26Z")
i see i see, i’ll try the configs of the topic and i’ll report back what i found
thanks for the help!!
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [February 19, 2026, 4:29am UTC](https://discuss.elastic.co/t/logstash-filebeat-lag-issue-logs-delayed-by-hours/385101/14 "2026-02-19T04:29:14Z")
> [@Cesar\_Mejia](#):
>
> Cause what i am monitoring rotates logs very frecuently under pressure and generates a massive volume
This is important information as it may suggest that your issue is on Filebeat side.
If your source logs are rotating faster than Filebeat can process them, they could pile up and lead to delay and data loss.
Looking at what you shared I didn't see anything in Logstash that could lead to a delay and you have plenty of resources on the Logstash server.
Can you add the ruby filter shared previously to your pipeline so a timestamp of when Logstash processed the event is added to your documents and then share some sample events from Kibana showing all three time information?
---
### Author:  [@RainTown](https://discuss.elastic.co/u/RainTown)
#### Post date: [February 19, 2026, 7:47am UTC](https://discuss.elastic.co/t/logstash-filebeat-lag-issue-logs-delayed-by-hours/385101/15 "2026-02-19T07:47:57Z")
That other topic with connection reset by peer messages seems different. Effectively it was a quiet TCP connection , with no real traffic, so got closed after a idle timeout, which can be prevented with different configuration options.
Check if the delayed logs are from same host(s) as appear in those reset log entries. Might be a red herring.
The crucial part is the various timestamps, what’s the time of the actual log entry, when did filebeat process the log, when did logstash process the log , when did elasticsearch process the log.
---
### Author:  [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [February 19, 2026, 8:01am UTC](https://discuss.elastic.co/t/logstash-filebeat-lag-issue-logs-delayed-by-hours/385101/16 "2026-02-19T08:01:44Z")
Thanks Kevin for the tip.
I'm sure Cesar will check any reasonable possibility for those cases.
---
### Author:  [@Cesar\_Mejia](https://discuss.elastic.co/u/Cesar_Mejia)
#### Post date: [February 19, 2026, 5:07pm UTC](https://discuss.elastic.co/t/logstash-filebeat-lag-issue-logs-delayed-by-hours/385101/17 "2026-02-19T17:07:49Z")
@leandrojmp I just added the logstash timestamp these are the results:
I reviewed my architecture and I cannot remove the clone filter, as the duplicated raw events are required by downstream systems and in the filebeat log i’m seeing this:
```auto
2026-02-19T11:06:16.538-0600 ERROR [logstash] logstash/async.go:280 Failed to publish events caused by: write tcp IP:PORT->LOGSTASHIP:4003: write: connection reset by peer
2026-02-19T11:06:16.538-0600 INFO [publisher] pipeline/retry.go:219 retryer: send unwait signal to consumer
2026-02-19T11:06:16.538-0600 INFO [publisher] pipeline/retry.go:223 done
2026-02-19T11:06:17.492-0600 ERROR [publisher_pipeline_output] pipeline/output.go:180 failed to publish events: write tcp IP:PORT->LOGSTASHIP:4004: write: connection reset by peer
2026-02-19T11:06:17.787-0600 ERROR [publisher_pipeline_output]
```
I commented out the stdin and implemented a filter to only process non-clones
---
### Author:  [@Cesar\_Mejia](https://discuss.elastic.co/u/Cesar_Mejia)
#### Post date: [February 24, 2026, 5:03pm UTC](https://discuss.elastic.co/t/logstash-filebeat-lag-issue-logs-delayed-by-hours/385101/18 "2026-02-24T17:03:03Z")
@leandrojmp@RainTown What should I check next? After adding the ls\_timestamp, there’s no proof Logstash or Elasticsearch are causing the issue; the only remaining factor is Filebeat. This is a Kibana screenshot: there are two logs harvested at the same time but created by my app at different time instances. This is my Filebeat config:
```yaml
filebeat.config.modules:
path: ${path.config}/modules.d/*.yml
reload.enabled: false
queue.mem:
events: 4096
flush.min_events: 512
flush.timeout: 2s
filebeat.inputs:
# ================== WAP / TOMCAT ==================
- type: filestream
id: tomcat-wap-logs
enabled: true
paths:
- /apache-tomcat-ws*/logs/catalina.out
- /var/log/tomcats/*/catalina.out
exclude_lines: ['.*MemcachedConnection.*','.*INFO: Added.*','.*Shut down memcached client.*','.*Could not redistribute to another node.*','.*Conexiones activas.*','.*ZV - EvaluarCondicion.*','.*evaluacion de resultado.*','.*Hay nodos.*','.*Cache hit.*']
fields:
log_type: "wap"
fields_under_root: true
tags: ["wap"]
message_max_bytes: 10485760
close.on_state_change.renamed: true
close.on_state_change.removed: true
close.on_state_change.inactive: 5m
clean_inactive: 15m
ignore_older: 72h
# ================== COLAS SMPP ==================
- type: filestream
id: colas-smpp-logs
enabled: true
paths:
- /var/log/smpp*.log
exclude_lines: ['.*MemcachedConnection.*','.*INFO: Added.*','.*Shut down memcached client.*','.*Could not redistribute to another node.*','.*Conexiones activas.*','.*ZV - EvaluarCondicion.*','.*evaluacion de resultado.*','.*Hay nodos.*','.*Cache hit.*']
fields:
log_type: "colas-smpp"
fields_under_root: true
close.on_state_change.renamed: true
close.on_state_change.removed: true
close.on_state_change.inactive: 1m
clean_inactive: 2h
ignore_older: 72h
# ================ RECEPTORES SMS ================
- type: filestream
id: receptores-sms-logs
enabled: true
paths:
- /var/log/receptor*.log
exclude_lines: ['.*MemcachedConnection.*','.*INFO: Added.*','.*Shut down memcached client.*','.*Could not redistribute to another node.*','.*Conexiones activas.*','.*ZV - EvaluarCondicion.*','.*evaluacion de resultado.*','.*Hay nodos.*','.*Cache hit.*']
fields:
log_type: "receptores-sms"
fields_under_root: true
close.on_state_change.renamed: true
close.on_state_change.removed: true
close.on_state_change.inactive: 1m
clean_inactive: 2h
ignore_older: 72h
# ==================== SALIDA ====================
output.logstash:
hosts: ["LOGSTASH:4000","LOGSTASH:4001","LOGSTASH:4002","LOGSTASH:4003","LOGSTASH:4004"]
bulk_max_size: 2048
worker: 5
loadbalance: true
compression_level: 3
ttl: 5m
pipelining: 5
timeout: 300
# ==================== LOGGING ===================
logging.level: info
logging.to_files: true
logging.to_syslog: false
logging.files:
path: /var/log/filebeat
name: filebeat.log
keepfiles: 7
permissions: 0600
```
These are the only errors I found, but as I understand it, Logstash closes the connection to save resources and reopens it when needed:
```bash
2026-02-24T10:54:34.606-0600 ERROR [logstash] logstash/async.go:280 Failed to publish events caused by: write tcp 172.22.58.98:37404->172.24.20.18:4004: write: connection reset by peer
2026-02-24T10:54:34.606-0600 INFO [publisher] pipeline/retry.go:219 retryer: send unwait signal to consumer
2026-02-24T10:54:34.606-0600 INFO [publisher] pipeline/retry.go:223 done
2026-02-24T10:54:34.614-0600 ERROR [logstash] logstash/async.go:280 Failed to publish events caused by: write tcp 172.22.58.98:39440->172.24.20.18:4003: write: connection reset by peer
2026-02-24T10:54:34.614-0600 INFO [publisher] pipeline/retry.go:219 retryer: send unwait signal to consumer
2026-02-24T10:54:34.614-0600 INFO [publisher] pipeline/retry.go:223 done
2026-02-24T10:54:34.621-0600 ERROR [logstash] logstash/async.go:280 Failed to publish events caused by: write tcp IP:PORT->LOGSTASHIP:4001: write: connection reset by peer
2026-02-24T10:54:34.621-0600 INFO [publisher] pipeline/retry.go:219 retryer: send unwait signal to consumer
2026-02-24T10:54:34.621-0600 INFO [publisher] pipeline/retry.go:223 done
2026-02-24T10:54:34.627-0600 ERROR [logstash] logstash/async.go:280 Failed to publish events caused by: write tcp IP:PORT->LOGSTASHIP:PORT: write: connection reset by peer
2026-02-24T10:54:34.627-0600 INFO [publisher] pipeline/retry.go:219 retryer: send unwait signal to consumer
2026-02-24T10:54:34.627-0600 INFO [publisher] pipeline/retry.go:223 done
2026-02-24T10:54:35.882-0600 ERROR [publisher_pipeline_output] pipeline/output.go:180 failed to publish events: write tcp IP:PORT->LOGSTASHIP:PORT: write: connection reset by peer
2026-02-24T10:54:36.075-0600 ERROR [publisher_pipeline_output] pipeline/output.go:180 failed to publish events: write tcp IP:PORT->LOGSTASHIP:PORT: write: connection reset by peer
2026-02-24T10:54:36.388-0600 ERROR [publisher_pipeline_output] pipeline/output.go:180 failed to publish events: write tcp IP:PORT->LOGSTASHIP:PORT: write: connection reset by peer
2026-02-24T10:54:36.437-0600 ERROR [publisher_pipeline_output] pipeline/output.go:180 failed to publish events: write tcp IP:PORT->LOGSTASHIP:PORT: write: connection reset by peer
```
Thanks for looking into this
---
### Author:  [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [February 24, 2026, 7:04pm UTC](https://discuss.elastic.co/t/logstash-filebeat-lag-issue-logs-delayed-by-hours/385101/19 "2026-02-24T19:04:59Z")
> [@Cesar\_Mejia](#):
>
> ` connection reset by peer`
Maybe this will help...
On Logstash side:
- Increase `client_inactivity_timeout` , default value is 60sec
On Filebeat side:
- increase `ttl` , disable `pipelining:0`
```auto
```
---
### Author:  [@Cesar\_Mejia](https://discuss.elastic.co/u/Cesar_Mejia)
#### Post date: [February 24, 2026, 8:17pm UTC](https://discuss.elastic.co/t/logstash-filebeat-lag-issue-logs-delayed-by-hours/385101/20 "2026-02-24T20:17:22Z")
i’ll try it!
[Next page](https://discuss.elastic.co/t/logstash-filebeat-lag-issue-logs-delayed-by-hours/385101.md?page=2)