Logstash output traffic significantly higher than input (minimal transformations) + TCP RST

[vasek (Václav Šulc)]

I’ve opened a question specifically about the RST behavior here:

Why does Logstash close idle TCP connections with RST instead of FIN?

Hi Elastic team, I’m trying to better understand how client_inactivity_timeout works in Logstash. I’ve noticed that when this timeout is reached, Logstash closes the TCP connection by sending a RST, even though the connection is still technically alive — TCP keep-alives are being sent by Winlogbeat every ~15 seconds and acknowledged by Logstash (confirmed via Wireshark). As I understand it: client_inactivity_timeout is based only on application-level data (e.g., log events), TCP-level activ…

Hopefully someone from the Elastic team can provide more insight or consider addressing it if it makes sense.