# Unable to send logs from Filebeat to Logstash – EOF on TCP connection

**URL:** <https://discuss.elastic.co/t/unable-to-send-logs-from-filebeat-to-logstash-eof-on-tcp-connection/380791>\
**Category:** Logstash\
**Created:** [August 6, 2025, 8:13am UTC](https://discuss.elastic.co/t/unable-to-send-logs-from-filebeat-to-logstash-eof-on-tcp-connection/380791 "2025-08-06T08:13:08Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![anhtaw](https://avatars.discourse-cdn.com/v4/letter/a/d9b06d/32.png) [@anhtaw](https://discuss.elastic.co/u/anhtaw)\
**Post date:** [August 6, 2025, 8:13am UTC](https://discuss.elastic.co/t/unable-to-send-logs-from-filebeat-to-logstash-eof-on-tcp-connection/380791/1 "2025-08-06T08:13:08Z")

</div>

I'm deploying Logstash on EKS and trying to expose it on port 443 using HAProxy Ingress. I'm using Filebeat to send logs to Logstash via the Beats protocol (Lumberjack), but I’m getting the following errors:

```auto
Failed to connect to backoff(async(tcp://<my-domain>:443)): EOF
failed-to-publish-events-caused-by-lumberjack-protocol-error

```

Here is my Ingress configuration. Am I missing something, or is it wrong to expose Beats protocol via HTTP Ingress? test local Failed to connect to backoff(async(tcp://:443)): EOF","service.name":"filebeat","ecs.version":"1.6.0"} or failed-to-publish-events-caused-by-lumberjack-protocol-error my config

```auto
apiVersion: networking .k8s .io/v1
kind: Ingress
metadata:
  name: filebeat-http
  namespace: k8s-alert
  uid: c2f1a533-bc3e-4f97-8b21-9f53ec97081d
  resourceVersion: '267388500'
  generation: 1
  creationTimestamp: '2025-08-06T02:12:25Z'
  labels:
    k8slens-edit-resource-version: v1
  annotations:
    cert-manager.io/cluster-issuer: cncf-le
    haproxy.org/ssl-redirect: 'true'
    haproxy.org/ssl-passthrough: "true"
    ingress.kubernetes.io/backend-protocol: TCP
spec:
  ingressClassName: haproxy-k8s
  tls:
    - hosts:
        - filebeats io
      secretName: tls-filebeats-ingress
  rules:
    - host: filebeat .io
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: logstash
                port:
                  number: 5044

```

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [August 7, 2025, 1:09pm UTC](https://discuss.elastic.co/t/unable-to-send-logs-from-filebeat-to-logstash-eof-on-tcp-connection/380791/2 "2025-08-07T13:09:44Z")

</div>

> [@anhtaw](#):
>
> Am I missing something, or is it wrong to expose Beats protocol via HTTP Ingress?

Yes, beats does not use HTTP, it is a proprietary protocol over TCP, so you need to use TCP.