This functionality is experimental and may be changed or removed completely in a future release. Elastic will take a best effort approach to fix any issues, but experimental features are not subject to the support SLA of official GA features.
Journalbeat requires a persistent TCP connection to Logstash. If a firewall interferes with the connection, you might see errors like this:
Failed to publish events caused by: write tcp ... write: connection reset by peer
To solve the problem:
- make sure the firewall is not closing connections between Journalbeat and Logstash, or
ttlvalue in the Logstash output to a value that’s lower than the maximum time allowed by the firewall, and set
pipeliningto 0 (pipelining cannot be enabled when