# Proofpoint Integration Web Socket Unregistering

**URL:** <https://discuss.elastic.co/t/proofpoint-integration-web-socket-unregistering/371103>\
**Category:** Elastic Agent\
**Tags:** filebeat\
**Created:** [November 26, 2024, 9:52pm UTC](https://discuss.elastic.co/t/proofpoint-integration-web-socket-unregistering/371103 "2024-11-26T21:52:10Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![elasticfantastik](https://avatars.discourse-cdn.com/v4/letter/e/ecd19e/32.png) [@elasticfantastik](https://discuss.elastic.co/u/elasticfantastik)\
**Post date:** [November 26, 2024, 9:52pm UTC](https://discuss.elastic.co/t/proofpoint-integration-web-socket-unregistering/371103/1 "2024-11-26T21:52:10Z")

</div>

We have an elastic agent running a "Proofpoint On Demand" integration. However, it sporadically stops getting data. To clarify, we poll the API once every hour, and at some unpredictable point, it completely stops getting data. The only thing that helps is restarting the elastic agent, which makes the integration work again as expected. We've verified our Proofpoint API key works via curls, so it doesn't seem to have anything to do with API rate limits or timeouts. In elastic's error logs we see the following:

```auto
15:01:48.041
[elastic_agent.filebeat][info] Connection to backoff(async(tcp://our-logstash:80)) established

15:57:59.680
[elastic_agent.filebeat][error] Input 'websocket' failed with: input websocket-proofpoint_on_demand.mail-3b7399ba-2f22-4665-b00f-94c8007e71c3 failed: read tcp 10.50.49.182:36012->52.24.230.185:443: read: connection timed out

15:57:59.680
[elastic_agent.filebeat][error] failed to read websocket data

15:57:59.680
[elastic_agent.filebeat][info] unregistering

15:58:02.752
[elastic_agent.filebeat][error] failed to read websocket data

15:58:02.752
[elastic_agent.filebeat][info] unregistering

```

We are hoping to understand how to resolve this issue. In particular, it's bizarre that the integration fully unregisters as opposed to trying again later. Is there a way to change this unregistration behavior?

---

<div class="post-metadata">

**Author:** ![strawgate](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/strawgate/32/131008_2.png) [@strawgate](https://discuss.elastic.co/u/strawgate)\
**Post date:** [November 27, 2024, 7:28pm UTC](https://discuss.elastic.co/t/proofpoint-integration-web-socket-unregistering/371103/2 "2024-11-27T19:28:11Z")

</div>

Hi, websockets disconnecting can be caused by a number of things including firewalls. There is an issue open in the integrations repository here [[proofpoint\_on\_demand]: Datastreams do not recover after websocket error · Issue #11816 · elastic/integrations · GitHub](https://github.com/elastic/integrations/issues/11816) where someone has reported a similar issue that you could comment on indicating you're having the same issue