This documentation contains work-in-progress information for future Elastic Stack and Cloud releases. Use the version selector to view supported release docs. It also contains some Elastic Cloud serverless information. Check out our serverless docs for more details.
Publishing to Logstash fails with "connection reset by peer" message
editPublishing to Logstash fails with "connection reset by peer" message
editAuditbeat requires a persistent TCP connection to Logstash. If a firewall interferes with the connection, you might see errors like this:
Failed to publish events caused by: write tcp ... write: connection reset by peer
To solve the problem:
- make sure the firewall is not closing connections between Auditbeat and Logstash, or
-
set the
ttlvalue in the Logstash output to a value that’s lower than the maximum time allowed by the firewall, and setpipeliningto 0 (pipelining cannot be enabled whenttlis used).