{"action":"created","issue":{"url":"https://api.github.com/repos/elastic/logstash-forwarder/issues/293","labels_url":"https://api.github.com/repos/elastic/logstash-forwarder/issues/293/labels{/name}","comments_url":"https://api.github.com/repos/elastic/logstash-forwarder/issues/293/comments","events_url":"https://api.github.com/repos/elastic/logstash-forwarder/issues/293/events","html_url":"https://github.com/elastic/logstash-forwarder/issues/293","id":46722774,"number":293,"title":"Read error looking for ack: EOF","user":{"login":"robin13","id":174291,"avatar_url":"https://avatars.githubusercontent.com/u/174291?v=3","gravatar_id":"","url":"https://api.github.com/users/robin13","html_url":"https://github.com/robin13","followers_url":"https://api.github.com/users/robin13/followers","following_url":"https://api.github.com/users/robin13/following{/other_user}","gists_url":"https://api.github.com/users/robin13/gists{/gist_id}","starred_url":"https://api.github.com/users/robin13/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/robin13/subscriptions","organizations_url":"https://api.github.com/users/robin13/orgs","repos_url":"https://api.github.com/users/robin13/repos","events_url":"https://api.github.com/users/robin13/events{/privacy}","received_events_url":"https://api.github.com/users/robin13/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":53,"created_at":"2014-10-24T10:07:18Z","updated_at":"2015-06-12T13:49:31Z","closed_at":null,"body":"Since upgrading to (0.3.1 / 0632ce)[https://github.com/elasticsearch/logstash-forwarder/commit/0632ce3952fb4e941ec520d9fad05a3e10955dc4] I've been getting this error a lot, but strangely only on the boxes where there is relatively little activity.  The boxes which are sending hundreds of events per second never have this error, but where there are fewer events being sent it looks like this:\r\n\r\n```\r\n2014/10/24 12:02:21.681463 Setting trusted CA from file: /opt/our-configuration/logstash-forwarder/elk-cluster.crt\r\n2014/10/24 12:02:21.683663 Connecting to [10.128.248.146]:5044 (es106.our.domain.com)\r\n2014/10/24 12:02:21.743082 Connected to 10.128.248.146\r\n2014/10/24 12:02:21.745460 Registrar: precessing 6 events\r\n2014/10/24 12:02:31.680960 Read error looking for ack: EOF\r\n2014/10/24 12:02:31.681032 Setting trusted CA from file: /opt/our-configuration/logstash-forwarder/elk-cluster.crt\r\n2014/10/24 12:02:31.683085 Connecting to [10.128.248.149]:5044 (es109.our.domain.com)\r\n2014/10/24 12:02:31.747049 Connected to 10.128.248.149\r\n2014/10/24 12:02:31.752734 Registrar: precessing 6 events\r\n2014/10/24 12:02:41.683922 Registrar: precessing 6 events\r\n2014/10/24 12:02:51.681371 Read error looking for ack: EOF\r\n2014/10/24 12:02:51.681447 Setting trusted CA from file: /opt/our-configuration/logstash-forwarder/elk-cluster.crt\r\n2014/10/24 12:02:51.683464 Connecting to [10.128.248.147]:5044 (es107.our.domain.com)\r\n2014/10/24 12:02:51.743022 Connected to 10.128.248.147\r\n2014/10/24 12:02:51.745627 Registrar: precessing 6 events\r\n2014/10/24 12:03:01.681006 Read error looking for ack: EOF\r\n2014/10/24 12:03:01.681074 Setting trusted CA from file: /opt/our-configuration/logstash-forwarder/elk-cluster.crt\r\n2014/10/24 12:03:01.686820 Connecting to [10.128.248.150]:5044 (es110.our.domain.com)\r\n2014/10/24 12:03:01.751134 Connected to 10.128.248.150\r\n2014/10/24 12:03:01.753258 Registrar: precessing 6 events\r\n```\r\nAs you can see, always on the dot 10 seconds after the last log event, even though I've got the timeout set to 30s in the logstash-forwarder.conf\r\n```\r\n      \"timeout\": 30\r\n```\r\nAny ideas what could be going on here?"},"comment":{"url":"https://api.github.com/repos/elastic/logstash-forwarder/issues/comments/111498175","html_url":"https://github.com/elastic/logstash-forwarder/issues/293#issuecomment-111498175","issue_url":"https://api.github.com/repos/elastic/logstash-forwarder/issues/293","id":111498175,"user":{"login":"driskell","id":939815,"avatar_url":"https://avatars.githubusercontent.com/u/939815?v=3","gravatar_id":"","url":"https://api.github.com/users/driskell","html_url":"https://github.com/driskell","followers_url":"https://api.github.com/users/driskell/followers","following_url":"https://api.github.com/users/driskell/following{/other_user}","gists_url":"https://api.github.com/users/driskell/gists{/gist_id}","starred_url":"https://api.github.com/users/driskell/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/driskell/subscriptions","organizations_url":"https://api.github.com/users/driskell/orgs","repos_url":"https://api.github.com/users/driskell/repos","events_url":"https://api.github.com/users/driskell/events{/privacy}","received_events_url":"https://api.github.com/users/driskell/received_events","type":"User","site_admin":false},"created_at":"2015-06-12T13:49:31Z","updated_at":"2015-06-12T13:49:31Z","body":"@ph Doesn't look like it: https://github.com/elastic/logstash-forwarder/blob/v0.4.0/lib/lumberjack/server.rb#L220\r\nI can't actually find latest lumberjack code though so I'm assuming it's not changed recently - seems removed from forwarder repository but no idea where it actually went..."}}