Starting in version 7.16, this experimental functionality has been removed. You should use the journald input in Filebeat instead.
Journalbeat requires a persistent TCP connection to Logstash. If a firewall interferes with the connection, you might see errors like this:
Failed to publish events caused by: write tcp ... write: connection reset by peer
To solve the problem:
- make sure the firewall is not closing connections between Journalbeat and Logstash, or
ttlvalue in the Logstash output to a value that’s lower than the maximum time allowed by the firewall, and set
pipeliningto 0 (pipelining cannot be enabled when