IMPORTANT: No additional bug fixes or documentation updates
will be released for this version. For the latest information, see the
current release documentation.
Publishing to Logstash fails with "connection reset by peer" message
editPublishing to Logstash fails with "connection reset by peer" message
editWinlogbeat requires a persistent TCP connection to Logstash. If a firewall interferes with the connection, you might see errors like this:
Failed to publish events caused by: write tcp ... write: connection reset by peer
To solve the problem:
- make sure the firewall is not closing connections between Winlogbeat and Logstash, or
-
set the
ttlvalue in the Logstash output to a value that’s lower than the maximum time allowed by the firewall, and setpipeliningto 0 (pipelining cannot be enabled whenttlis used).