{"action":"closed","issue":{"url":"https://api.github.com/repos/elastic/beats/issues/875","repository_url":"https://api.github.com/repos/elastic/beats","labels_url":"https://api.github.com/repos/elastic/beats/issues/875/labels{/name}","comments_url":"https://api.github.com/repos/elastic/beats/issues/875/comments","events_url":"https://api.github.com/repos/elastic/beats/issues/875/events","html_url":"https://github.com/elastic/beats/issues/875","id":129377826,"number":875,"title":"Error publishing events in filebeat logged as INFO","user":{"login":"ddikman","id":8461739,"avatar_url":"https://avatars.githubusercontent.com/u/8461739?v=3","gravatar_id":"","url":"https://api.github.com/users/ddikman","html_url":"https://github.com/ddikman","followers_url":"https://api.github.com/users/ddikman/followers","following_url":"https://api.github.com/users/ddikman/following{/other_user}","gists_url":"https://api.github.com/users/ddikman/gists{/gist_id}","starred_url":"https://api.github.com/users/ddikman/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ddikman/subscriptions","organizations_url":"https://api.github.com/users/ddikman/orgs","repos_url":"https://api.github.com/users/ddikman/repos","events_url":"https://api.github.com/users/ddikman/events{/privacy}","received_events_url":"https://api.github.com/users/ddikman/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/elastic/beats/labels/enhancement","name":"enhancement","color":"fbca04"},{"url":"https://api.github.com/repos/elastic/beats/labels/Filebeat","name":"Filebeat","color":"008000"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":6,"created_at":"2016-01-28T08:30:42Z","updated_at":"2016-04-27T09:13:24Z","closed_at":"2016-04-27T09:13:23Z","body":"When setting up filebeat it's easy to get the configuration wrong the first time, not to mention any other issues you might have with connectivity to logstash etc. In my case I had some errors connecting. I had the error level set to \"error\" meaning no log was created when filebeat started so I couldn't know if it even started, I simply didn't get any error.\r\n\r\nThe reason nothing got posted (which I found after increasing the log level and verifying the log path) was this:\r\n```\r\nINFO Error publishing events (retrying): write tcp xxx.xxx.xxx.xxx:50377->yyy.yyy.yyy.yyy:9300: write: broken pipe\r\n```\r\n\r\nIf this would've been logged as an error, which I expect it should since it stops events from getting published I could've picked up on the issue. Would it be possible to change?\r\n\r\nAdditional log entries:\r\n```\r\n2016-01-28T08:22:33Z DBG  Forward preprocessed events\r\n2016-01-28T08:22:33Z DBG  output worker: publish 6 events\r\n2016-01-28T08:22:33Z DBG  Try to publish %!s(int=6) events to logstash with window size %!s(int=10)\r\n2016-01-28T08:22:33Z DBG  %!s(int=0) events out of %!s(int=6) events sent to logstash. Continue sending ...\r\n2016-01-28T08:22:33Z INFO Error publishing events (retrying): write tcp xxx.xxx.xxx.xxx:50347->yyy.yyy.yyy.yyy:9300: write: broken pipe\r\n2016-01-28T08:22:33Z INFO send fail\r\n2016-01-28T08:22:33Z INFO backoff retry: 1s\r\n2016-01-28T08:22:34Z DBG  Try to publish %!s(int=6) events to logstash with window size %!s(int=10)\r\n2016-01-28T08:22:34Z DBG  %!s(int=0) events out of %!s(int=6) events sent to logstash. Continue sending ...\r\n2016-01-28T08:22:34Z INFO Error publishing events (retrying): write tcp xxx.xxx.xxx.xxx:50349->yyy.yyy.yyy.yyy:9300: write: broken pipe\r\n2016-01-28T08:22:34Z INFO send fail\r\n2016-01-28T08:22:34Z INFO backoff retry: 2s\r\n\r\n```"}}