# Logstash is not accepting my Filebeat logs **URL:** \ **Category:** Logstash\ **Created:** [March 6, 2017, 5:55pm UTC](https://discuss.elastic.co/t/logstash-is-not-accepting-my-filebeat-logs/77555 "2017-03-06T17:55:33Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![wmstein](https://avatars.discourse-cdn.com/v4/letter/w/a8b319/32.png) [@wmstein](https://discuss.elastic.co/u/wmstein)\ **Post date:** [March 6, 2017, 5:55pm UTC](https://discuss.elastic.co/t/logstash-is-not-accepting-my-filebeat-logs/77555/1 "2017-03-06T17:55:33Z")
Filebeat is on a prod server and Logstash is on a different servers.. I can not figure out why Logstash is rejecting my Filebeat log pushes. Below is the Logstash error. And below that shows telnet to port 5044 works. ELK versions aree 5.2.2 2017-03-06T17:47:24Z INFO Error publishing events (retrying): read tcp 10.0.0.165:39710-\>10.0.0.212:5044: read: connection reset by peer 2017-03-06T17:47:39Z INFO Non-zero metrics in the last 30s: filebeat.harvester.open\_files=4 libbeat.logstash.publish.read\_errors=5 filebeat.harvester.started=4 filebeat.harvester.running=4 libbeat.publisher.published\_events=2044 libbeat.logstash.call\_count.PublishEvents=5 libbeat.logstash.published\_but\_not\_acked\_events=10220 libbeat.logstash.publish.write\_bytes=2180 2017-03-06T17:47:40Z ERR Failed to publish events caused by: read tcp 10.0.0.165:39716-\>10.0.0.212:5044: read: connection reset by peer 2017-03-06T17:47:40Z INFO Error publishing events (retrying): read tcp 10.0.0.165:39716-\>10.0.0.212:5044: read: connection reset by peer 2017-03-06T17:48:09Z INFO Non-zero metrics in the last 30s: libbeat.logstash.publish.read\_errors=1 libbeat.logstash.publish.write\_bytes=308 libbeat.logstash.published\_but\_not\_acked\_events=2044 libbeat.logstash.call\_count.PublishEvents=1 2017-03-06T17:48:12Z ERR Failed to publish events caused by: read tcp 10.0.0.165:39774-\>10.0.0.212:5044: read: connection reset by peer 2017-03-06T17:48:12Z INFO Error publishing events (retrying): read tcp 10.0.0.165:39774-\>10.0.0.212:5044: read: connection reset by peer 2017-03-06T17:48:39Z INFO Non-zero metrics in the last 30s: libbeat.logstash.call\_count.PublishEvents=1 libbeat.logstash.publish.read\_errors=1 libbeat.logstash.publish.write\_bytes=307 libbeat.logstash.published\_but\_not\_acked\_events=2044 2017-03-06T17:49:09Z INFO No non-zero metrics in the last 30s 2017-03-06T17:49:12Z ERR Failed to publish events caused by: read tcp 10.0.0.165:39788-\>10.0.0.212:5044: read: connection reset by peer 2017-03-06T17:49:12Z INFO Error publishing events (retrying): read tcp 10.0.0.165:39788-\>10.0.0.212:5044: read: connection reset by peer 2017-03-06T17:49:39Z INFO Non-zero metrics in the last 30s: libbeat.logstash.publish.write\_bytes=311 libbeat.logstash.published\_but\_not\_acked\_events=2044 libbeat.logstash.publish.read\_errors=1 libbeat.logstash.call\_count.PublishEvents=1 2017-03-06T17:50:09Z INFO No non-zero metrics in the last 30s ubuntu@ip-10-0-0-165:/etc/filebeat-PROD!!!$ telnet 10.0.0.212 5044 Trying 10.0.0.212... Connected to 10.0.0.212. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [March 9, 2017, 12:27pm UTC](https://discuss.elastic.co/t/logstash-is-not-accepting-my-filebeat-logs/77555/2 "2017-03-09T12:27:51Z")
Have you configured Logstash but not Filebeat to use SSL, or vice versa? ---
**Author:** ![wmstein](https://avatars.discourse-cdn.com/v4/letter/w/a8b319/32.png) [@wmstein](https://discuss.elastic.co/u/wmstein)\ **Post date:** [March 9, 2017, 2:18pm UTC](https://discuss.elastic.co/t/logstash-is-not-accepting-my-filebeat-logs/77555/3 "2017-03-09T14:18:24Z")
Here is the logstash config file for input on the ELK server cat 02-beats-input.conf input { beats { port =\> 5044 type =\> "logs" ssl =\> true ssl\_certificate =\> "/etc/pki/tls/certs/logstash-forwarder.crt" ssl\_key =\> "/etc/pki/tls/private/logstash-forwarder.key" client\_inactivity\_timeout =\> "36000" } } And here is the filebeat.yml from the prod server. Please ignore the comments - i've been trying everything i read on the forum to get to work. cat /etc/filebeat/filebeat.yml filebeat: prospectors: - paths: #- /var/log/_.log - /var/log/syslog - /var/log/apache2/_.log # NEW! input\_type: log registry\_file: /var/lib/filebeat/registry # output.logstash: # The Logstash hosts #hosts: ["localhost:5044"] # hosts: ["10.0.0.212:5044"] # #hosts: ["[elkserver.planetecosystems.com:5044](http://elkserver.planetecosystems.com:5044)"] # bulk\_max\_size: 1024 # tls: # # List of root certificates for HTTPS server verifications # certificate\_authorities: ["/etc/pki/tls/certs/logstash-forwarder.crt"] output: logstash: enabled: true hosts: ["10.0.0.212:5044"] worker: 1 tls: certificate\_authorities: ["/etc/pki/tls/certs/logstash-forwarder.crt"] shipper: logging: files: ------ Telnet works from prod box telnet 10.0.0.212 5044 Trying 10.0.0.212... Connected to 10.0.0.212. Escape character is '^]'. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [March 9, 2017, 2:27pm UTC](https://discuss.elastic.co/t/logstash-is-not-accepting-my-filebeat-logs/77555/4 "2017-03-09T14:27:02Z")
Please format your filebeat.yml as preformatted text when posting it here. If you don't all indentation is lost and indentation matters with YAML files. Have you tried disabling SSL on the Logstash side? If that works you know that the problem is that Filebeat doesn't use SSL. ---
**Author:** ![wmstein](https://avatars.discourse-cdn.com/v4/letter/w/a8b319/32.png) [@wmstein](https://discuss.elastic.co/u/wmstein)\ **Post date:** [March 9, 2017, 2:34pm UTC](https://discuss.elastic.co/t/logstash-is-not-accepting-my-filebeat-logs/77555/5 "2017-03-09T14:34:33Z")
ok good call. I changed Logstash to ssl =\> false and now i see f filebeat log index in: curl 'localhost:9200/\_cat/indices?v' thanks. so now how do i figure out why ssl is failing? If the public cert was bad then i assume the error would state that. What else so i explore to get ssl working ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [March 9, 2017, 2:46pm UTC](https://discuss.elastic.co/t/logstash-is-not-accepting-my-filebeat-logs/77555/6 "2017-03-09T14:46:24Z")
I repeat: Please format your filebeat.yml as preformatted text when posting it here. If you don't all indentation is lost and indentation matters with YAML files. ---
**Author:** ![wmstein](https://avatars.discourse-cdn.com/v4/letter/w/a8b319/32.png) [@wmstein](https://discuss.elastic.co/u/wmstein)\ **Post date:** [March 9, 2017, 2:48pm UTC](https://discuss.elastic.co/t/logstash-is-not-accepting-my-filebeat-logs/77555/7 "2017-03-09T14:48:53Z")
Sorry, thought that was going forward. ## filebeat.yml ``` filebeat: prospectors: - paths: #- /var/log/*.log - /var/log/syslog - /var/log/apache2/*.log # NEW! input_type: log registry_file: /var/lib/filebeat/registry #output.logstash: # # The Logstash hosts # #hosts: ["localhost:5044"] # hosts: ["10.0.0.212:5044"] # #hosts: ["elkserver.planetecosystems.com:5044"] # bulk_max_size: 1024 # tls: # # List of root certificates for HTTPS server verifications # certificate_authorities: ["/etc/pki/tls/certs/logstash-forwarder.crt"] output: logstash: enabled: true hosts: ["10.0.0.212:5044"] worker: 1 tls: certificate_authorities: ["/etc/pki/tls/certs/logstash-forwarder.crt"] shipper: logging: files: ``` ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [March 9, 2017, 2:55pm UTC](https://discuss.elastic.co/t/logstash-is-not-accepting-my-filebeat-logs/77555/8 "2017-03-09T14:55:00Z")
What version of Filebeat is this? According to [https://www.elastic.co/guide/en/beats/filebeat/current/logstash-output.html](https://www.elastic.co/guide/en/beats/filebeat/current/logstash-output.html) the `ssl` key enables SSL. There's no mention of a `tls` key. ---
**Author:** ![wmstein](https://avatars.discourse-cdn.com/v4/letter/w/a8b319/32.png) [@wmstein](https://discuss.elastic.co/u/wmstein)\ **Post date:** [March 9, 2017, 3:00pm UTC](https://discuss.elastic.co/t/logstash-is-not-accepting-my-filebeat-logs/77555/9 "2017-03-09T15:00:28Z")
Version: 5.2.2 ---
**Author:** ![wmstein](https://avatars.discourse-cdn.com/v4/letter/w/a8b319/32.png) [@wmstein](https://discuss.elastic.co/u/wmstein)\ **Post date:** [March 9, 2017, 3:05pm UTC](https://discuss.elastic.co/t/logstash-is-not-accepting-my-filebeat-logs/77555/10 "2017-03-09T15:05:19Z")
ok cool. i changed the yml to use ssl and changed logstash back to ssl =\> true looks good now. thanks ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 6, 2017, 3:05pm UTC](https://discuss.elastic.co/t/logstash-is-not-accepting-my-filebeat-logs/77555/11 "2017-04-06T15:05:29Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.