0

I am receiving this error message every time logstash-forwarder has a new log to ship. Eventually the connection gets made and logstash-forwarder output confirms that the events have been processed but I was hoping that there could a way to resolve this error.

Here is a sample of what is happening:

2015/01/25 18:51:46.116770 Read error looking for ack: EOF
2015/01/25 18:51:46.116831 Loading client ssl certificate: /opt/certs/logstash-forwarder.crt and /opt/certs/logstash-forwarder.key
2015/01/25 18:51:46.276102 Setting trusted CA from file: /opt/certs/logstash-forwarder.crt
2015/01/25 18:51:46.276453 Connecting to <IP>:4545 (<IP>)
2015/01/25 18:51:46.687068 Connected to <IP>
2015/01/25 18:51:46.736755 Read error looking for ack: EOF
2015/01/25 18:51:46.736857 Loading client ssl certificate: /opt/certs/logstash-forwarder.crt and /opt/certs/logstash-forwarder.key
2015/01/25 18:51:46.893790 Setting trusted CA from file: /opt/certs/logstash-forwarder.crt
2015/01/25 18:51:46.894110 Connecting to <IP>:4545 (<IP>)
2015/01/25 18:51:47.261252 Connected to <IP>
2015/01/25 18:51:47.343711 Registrar received 1 events

I am thinking there may be some timeout threshold happening, I have timeout: 15 set in my logstash-forwarder config. The Logstash server this is shipping isn't under any crazy amount of load but maybe there is something I can check there?

jmreicha
  • 790
  • 1
  • 16
  • 29

1 Answers1

1

Apparently the protocol doesn't handle slow responses from the server well at all. One user forked logstash-forwarder and made significant change to it in his fork, "Log Courier" which might be worth a shot.

ColinM
  • 701
  • 8
  • 19
  • I almost forgot about this :) I have been fighting this issue off and on for awhile now, I have tried Log courier as well but it has issues as well. I should probably update my original post with the newer stuff I have tried. – jmreicha Mar 19 '15 at 14:53
  • Log Courier seems to be working so far. – jmreicha Mar 20 '15 at 23:44
  • Thanks for the update. I actually somehow got logstash-forwarder to work well so I never switched. Not exactly sure what happened, but after a restart and fixing one host that had a bad SSL setup it started working. – ColinM Mar 20 '15 at 23:55