# Send log records with Filebeat over TCP

**URL:** https://discuss.elastic.co/t/send-log-records-with-filebeat-over-tcp/259331
**Category:** Beats
**Tags:** filebeat
**Created:** [December 22, 2020, 4:43am UTC](https://discuss.elastic.co/t/send-log-records-with-filebeat-over-tcp/259331 "2020-12-22T04:43:33Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![AClerk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aclerk/32/55297_2.png) [@AClerk](https://discuss.elastic.co/u/AClerk)
#### Post date: [December 22, 2020, 4:43am UTC](https://discuss.elastic.co/t/send-log-records-with-filebeat-over-tcp/259331/1 "2020-12-22T04:43:33Z")

</div>

Is there a way to send filebeats output to a TCP socket?  
I have tried using `output.logstash`  
As [written](https://www.elastic.co/guide/en/beats/filebeat/current/logstash-output.html) - _The Logstash output sends events directly to Logstash by using the lumberjack protocol, which runs over **TCP**._  
But it seems not to be working.

Any other suggestions? Solutions?

Cheers!

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [December 22, 2020, 6:18am UTC](https://discuss.elastic.co/t/send-log-records-with-filebeat-over-tcp/259331/2 "2020-12-22T06:18:05Z")

</div>

> [@AClerk](#):
>
> But it seems not to be working.

Elaborating on this comment might help determine the issue?

---

<div class="post-metadata">

### Author: ![AClerk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aclerk/32/55297_2.png) [@AClerk](https://discuss.elastic.co/u/AClerk)
#### Post date: [December 22, 2020, 10:54pm UTC](https://discuss.elastic.co/t/send-log-records-with-filebeat-over-tcp/259331/3 "2020-12-22T22:54:02Z")

</div>

> [@warkolm](#):
>
> Elaborating on this comment might help determine the issue?

I am getting errors like

```auto
2020-12-22T15:33:06.719+1100	DEBUG	[transport]	transport/client.go:205	handle error: read tcp <source_ip>:54734-><destination_ip>:514: i/o timeout

```

```auto
2020-12-22T15:33:06.719+1100	ERROR	[logstash]	logstash/async.go:280	Failed to publish events caused by: read tcp <source_ip>:54734-><destination_ip>:514: i/o timeout

```

```auto
2020-12-22T15:33:06.720+1100	ERROR	[logstash]	logstash/async.go:280	Failed to publish events caused by: client is not connected

```

Thanks

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [December 22, 2020, 11:48pm UTC](https://discuss.elastic.co/t/send-log-records-with-filebeat-over-tcp/259331/4 "2020-12-22T23:48:30Z")

</div>

Looks like it's not connected then. Can you telnet to the Logstash host on that port?

---

<div class="post-metadata">

### Author: ![AClerk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aclerk/32/55297_2.png) [@AClerk](https://discuss.elastic.co/u/AClerk)
#### Post date: [December 23, 2020, 12:19am UTC](https://discuss.elastic.co/t/send-log-records-with-filebeat-over-tcp/259331/5 "2020-12-23T00:19:46Z")

</div>

> [@warkolm](#):
>
> Can you telnet to the Logstash host on that port?

Yes.  
telnet connection is working.  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/3/a/3a1ce8c0be5d93abbfe225a8ce816ca52ce7e4f9.png)

Any other configurations I might be missing?

I can see messages in the filebeat logs that connection established

```auto
2020-12-23T10:27:49.956+1100 INFO [publisher_pipeline_output] pipeline/output.go:151 Connection to backoff(async(tcp://<dest_ip>:514)) established

```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 20, 2021, 2:19am UTC](https://discuss.elastic.co/t/send-log-records-with-filebeat-over-tcp/259331/6 "2021-01-20T02:19:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.