# Number of open sockets

**URL:** <https://discuss.elastic.co/t/number-of-open-sockets/320087>\
**Category:** Logstash\
**Tags:** docker\
**Created:** [November 29, 2022, 7:17pm UTC](https://discuss.elastic.co/t/number-of-open-sockets/320087 "2022-11-29T19:17:20Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![INS](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ins/32/92827_2.png) [@INS](https://discuss.elastic.co/u/INS)\
**Post date:** [November 29, 2022, 7:17pm UTC](https://discuss.elastic.co/t/number-of-open-sockets/320087/1 "2022-11-29T19:17:20Z")

</div>

Hi  
I'm getting regularly such output

```auto
>worker0] elasticsearch - Failed to perform request {:message=>"Connection reset", :exception=>Manticore::SocketException, :cause=>java.ne
[WARN] 2022-11-29 18:33:45.720 [[my_pipeline]>worker0] elasticsearch - Marking url as dead. Last error: [LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError] Elas30.226:9240/_bulk][Manticore::SocketException] Connection reset {:url=>http://e

```

in the logstash logs . I didn't find any suspicious point in the pcap logs between logstash container - elasticsearch 3 master nodes.  
I'm very curious how to check open sockets/connection to elasticsearch nodes?

---

<div class="post-metadata">

**Author:** ![elasticforme](https://avatars.discourse-cdn.com/v4/letter/e/f05b48/32.png) [@elasticforme](https://discuss.elastic.co/u/elasticforme)\
**Post date:** [November 29, 2022, 11:39pm UTC](https://discuss.elastic.co/t/number-of-open-sockets/320087/2 "2022-11-29T23:39:09Z")

</div>

by default logstash open connection is 16384 you can bump that up from startup file "logstash.service"

LimitNOFiles

also you can bump up your open socket connection in limits.conf  
logstash soft nofile 102400  
logstash hard nofile 202400

you can find open connection using netstat.  
netstat -a |grep ESTABLISHED | wc -l  
5120

you can also use lsof command

---

<div class="post-metadata">

**Author:** ![INS](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ins/32/92827_2.png) [@INS](https://discuss.elastic.co/u/INS)\
**Post date:** [November 30, 2022, 8:22am UTC](https://discuss.elastic.co/t/number-of-open-sockets/320087/3 "2022-11-30T08:22:26Z")

</div>

> [@elasticforme](#):
>
> logstash soft nofile

do You know maybe where should I check it under officially logstash docker container?

---

<div class="post-metadata">

**Author:** ![elasticforme](https://avatars.discourse-cdn.com/v4/letter/e/f05b48/32.png) [@elasticforme](https://discuss.elastic.co/u/elasticforme)\
**Post date:** [November 30, 2022, 2:19pm UTC](https://discuss.elastic.co/t/number-of-open-sockets/320087/4 "2022-11-30T14:19:36Z")

</div>

I am not familiar with docker

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 28, 2022, 2:20pm UTC](https://discuss.elastic.co/t/number-of-open-sockets/320087/5 "2022-12-28T14:20:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.