That error just means that the client (peer) disconnected albeit not gracefully.
It and of itself, may not indicate any issue. It may have just been that the remote client had finished sending data and dropped the connection.
Or it could be any number of other things, such as network disruption.
The challenge is working out which...
If you see it for nearly every request - that would strongly suggest that your sending application is not closing the connection when it has finished data. Again, not a massive issue, but ideally your sending application would close the connection once it has finished.
The problem is that depending on the libraries used by your client app, the requirement to close a connection can be ambiguous and abstracted away from the library in question.
See: https://stackoverflow.com/questions/10115126/python-requests-close-http-connection
If you maintain the HEC client code, review it and see if you can gracefully close the socket after the http session is finished - if you can't don't sweat it too much.
You could argue that it should be an INFO message rather than WARN, but in the case that your client does behave itself nicely, WARNs could be useful to diagnose network problems.
In short, if your environment is working and data is arriving on time then don't worry about it too much.
If my comment helps, please give it a thumbs up!
