IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
Auditbeat requires a persistent TCP connection to Logstash. If a firewall interferes with the connection, you might see errors like this:
Failed to publish events caused by: write tcp ... write: connection reset by peer
To solve the problem:
- make sure the firewall is not closing connections between Auditbeat and Logstash, or
ttlvalue in the Logstash output to a value that’s lower than the maximum time allowed by the firewall, and set
pipeliningto 0 (pipelining cannot be enabled when