# Output to Logstash - connection was forcibly closed by the remote host
**URL:** https://discuss.elastic.co/t/output-to-logstash-connection-was-forcibly-closed-by-the-remote-host/110194
**Category:** Beats
**Created:** [December 4, 2017, 5:46pm UTC](https://discuss.elastic.co/t/output-to-logstash-connection-was-forcibly-closed-by-the-remote-host/110194 "2017-12-04T17:46:00Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@rudee](https://discuss.elastic.co/u/rudee)
#### Post date: [December 4, 2017, 5:46pm UTC](https://discuss.elastic.co/t/output-to-logstash-connection-was-forcibly-closed-by-the-remote-host/110194/1 "2017-12-04T17:46:00Z")
Hi I am trying to test the winlogbeat and Elasticsearch the version is 5.6.4
I am new to Elastic, so still finding my way around.
(I have managed to get filebeat working and can see syslogs so the setup is working)
What Im now trying to do is to get winlogbeat working, but Im getting the below error, I have switched off the firewall, there is no AV and can telnet to the ports successfully.
I have followed the steps a couple of times now, with no luck
Logstash is running on port 5044
Elastic is running on port 9200
Here is the error from the logs
2017-12-04T16:05:06Z DBG connect to logstash host opscx1.ops.com:5044:10200
2017-12-04T16:05:07Z DBG handle error: read tcp 192.168.0.1:61223-\>192.168.0.173:5044: wsarecv: An existing connection was forcibly closed by the remote host.
2017-12-04T16:05:07Z DBG closing
2017-12-04T16:05:07Z DBG 0 events out of 100 events sent to logstash host opscx1.ops.com:5044:10200. Continue sending
2017-12-04T16:05:07Z DBG close connection to logstash host opscx1.ops.com:5044:10200
2017-12-04T16:05:07Z ERR Failed to publish events (host: opscx1.ops.com:5044:10200), caused by: read tcp 192.168.0.1:61223-\>192.168.0.173:5044: wsarecv: An existing connection was forcibly closed by the remote host.
Winlogbeat file
```auto
winlogbeat.event_logs:
- name: Application
ignore_older: 24h
- name: Security
ignore_older: 24h
- name: System
ignore_older: 24h
output.logstash:
# The Logstash hosts
hosts: ["opscx1.ops.com:5044"]
tls:
certificate_authorities: ["C:/ProgramData/winlogbeat/logstash-forwarder.crt"]
logging.to_files: true
logging.files:
path: C:/ProgramData/winlogbeat/Logs
logging.level: debug
```
Anyone have any ideas as Im worn out?
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [December 5, 2017, 2:38pm UTC](https://discuss.elastic.co/t/output-to-logstash-connection-was-forcibly-closed-by-the-remote-host/110194/2 "2017-12-05T14:38:04Z")
Do you have SSL enabled in Logstash?
The config option for defining the CA certificate in Beats is
`output.logstash.ssl.certificate_authorities`
but you have `tls` instead of `ssl`.
---
### Author:  [@rudee](https://discuss.elastic.co/u/rudee)
#### Post date: [December 5, 2017, 9:05pm UTC](https://discuss.elastic.co/t/output-to-logstash-connection-was-forcibly-closed-by-the-remote-host/110194/3 "2017-12-05T21:05:02Z")
> [@andrewkroh](#):
>
> Do you have SSL enabled in Logstash?
>
> The config option for defining the CA certificate in Beats is
>
> output.logstash.ssl.certificate\_authorities
>
> but you have tls instead of ssl.
thanks I'll get back to the drawing baord and get back to you, once I've figured it out
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 25, 2017, 5:46pm UTC](https://discuss.elastic.co/t/output-to-logstash-connection-was-forcibly-closed-by-the-remote-host/110194/4 "2017-12-25T17:46:07Z")
This topic was automatically closed after 21 days. New replies are no longer allowed.