﻿---
title: Publishing to Logstash fails with "connection reset by peer" message
description: Auditbeat requires a persistent TCP connection to Logstash. If a firewall interferes with the connection, you might see errors like this: To solve the...
url: https://docs-v3-preview.elastic.dev/elastic/beats/pull/48485/reference/auditbeat/publishing-ls-fails-connection-reset-by-peer
applies_to:
  - Elastic Stack: Generally available in 9.0+
---

# Publishing to Logstash fails with "connection reset by peer" message
Auditbeat requires a persistent TCP connection to Logstash. If a firewall interferes with the connection, you might see errors like this:
```shell
Failed to publish events caused by: write tcp ... write: connection reset by peer
```

To solve the problem:
- make sure the firewall is not closing connections between Auditbeat and Logstash, or
- set the `ttl` value in the [Logstash output](https://docs-v3-preview.elastic.dev/elastic/beats/pull/48485/reference/auditbeat/logstash-output) to a value that’s lower than the maximum time allowed by the firewall, and set `pipelining` to 0 (pipelining cannot be enabled when `ttl` is used).