# Can not run Logstash on my server

**URL:** <https://discuss.elastic.co/t/can-not-run-logstash-on-my-server/181715>\
**Category:** Logstash\
**Created:** [May 19, 2019, 4:21pm UTC](https://discuss.elastic.co/t/can-not-run-logstash-on-my-server/181715 "2019-05-19T16:21:20Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![zenimagine](https://avatars.discourse-cdn.com/v4/letter/z/3bc359/32.png) [@zenimagine](https://discuss.elastic.co/u/zenimagine)\
**Post date:** [May 19, 2019, 4:21pm UTC](https://discuss.elastic.co/t/can-not-run-logstash-on-my-server/181715/1 "2019-05-19T16:21:20Z")

</div>

I have 2 servers (Ubuntu 18.04) :

- [monitoring.example.com](http://monitoring.example.com) with ELK (ELK server)
- [www.example.com](http://www.example.com) with my Drupal site and Filebeat (Client server)

I generated an SSL certificate on ELK and sent it to the client server.

My configuration does not work. Why ?

On the Client server (Filebeat) :  
[https://pastebin.com/C2cz6RVa](https://pastebin.com/C2cz6RVa)

On the ELK server (Logstash) :  
[https://pastebin.com/Bnz0bbMr](https://pastebin.com/Bnz0bbMr)

**ON ELK :**

Elasticsearch

```
ubuntu@monitoring-example-com:~$ curl -v http://localhost:9200
* Rebuilt URL to: http://localhost:9200/
* Trying 127.0.0.1...
* TCP_NODELAY set
* Connected to localhost (127.0.0.1) port 9200 (#0)
> GET / HTTP/1.1
> Host: localhost:9200
> User-Agent: curl/7.58.0
> Accept: */*
> 
< HTTP/1.1 200 OK
< content-type: application/json; charset=UTF-8
< content-length: 517
< 
{
  "name" : "monitoring-example-com",
  "cluster_name" : "elasticsearch",
  "cluster_uuid" : "Evr7J-FJSWW7JBnZqWAfKg",
  "version" : {
    "number" : "7.0.1",
    "build_flavor" : "default",
    "build_type" : "deb",
    "build_hash" : "e4efvb5",
    "build_date" : "2019-04-29T12:56:03.145736Z",
    "build_snapshot" : false,
    "lucene_version" : "8.0.0",
    "minimum_wire_compatibility_version" : "6.7.0",
    "minimum_index_compatibility_version" : "6.0.0-beta1"
  },
  "tagline" : "You Know, for Search"
}
* Connection #0 to host localhost left intact

```

Kibana

```
ubuntu@monitoring-example-com:~$ curl -v http://localhost:5601
* Rebuilt URL to: http://localhost:5601/
* Trying 127.0.0.1...
* TCP_NODELAY set
* Connected to localhost (127.0.0.1) port 5601 (#0)
> GET / HTTP/1.1
> Host: localhost:5601
> User-Agent: curl/7.58.0
> Accept: */*
> 
< HTTP/1.1 302 Found
< location: /app/kibana
< kbn-name: kibana
< kbn-xpack-sig: c84b5f8679c25c04ce5r61b0d3b45afe
< content-type: text/html; charset=utf-8
< cache-control: no-cache
< content-length: 0
< connection: close
< Date: Sat, 18 May 2019 15:27:15 GMT
< 
* Closing connection 0

```

Logstash

```
ubuntu@monitoring-example-com:~$ curl -v http://localhost:5044
* Rebuilt URL to: http://localhost:5044/
* Trying 127.0.0.1...
* TCP_NODELAY set
* Connected to localhost (127.0.0.1) port 5044 (#0)
> GET / HTTP/1.1
> Host: localhost:5044
> User-Agent: curl/7.58.0
> Accept: */*
> 
* Recv failure: Connection reset by peer
* stopped the pause stream!
* Closing connection 0
curl: (56) Recv failure: Connection reset by peer
```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 19, 2019, 9:59pm UTC](https://discuss.elastic.co/t/can-not-run-logstash-on-my-server/181715/2 "2019-05-19T21:59:26Z")

</div>

1. What makes you think it does not work?

2. You should anchor your grok patterns to start of line with ^ if you can

---

<div class="post-metadata">

**Author:** ![zenimagine](https://avatars.discourse-cdn.com/v4/letter/z/3bc359/32.png) [@zenimagine](https://discuss.elastic.co/u/zenimagine)\
**Post date:** [May 19, 2019, 10:04pm UTC](https://discuss.elastic.co/t/can-not-run-logstash-on-my-server/181715/3 "2019-05-19T22:04:46Z")

</div>

1. This is an error message :

2. I took the following configuration :

> **[How To Install Elasticsearch, Logstash, and Kibana (Elastic Stack) on Ubuntu...](https://www.digitalocean.com/community/tutorials/how-to-install-elasticsearch-logstash-and-kibana-elastic-stack-on-ubuntu-16-04)**
>
> In this tutorial, we will go over the installation of the Elasticsearch ELK Stack on Ubuntu 16.04 (that is, Elasticsearch 2.3.x, Logstash 2.3.x, and Kibana 4…

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 19, 2019, 10:33pm UTC](https://discuss.elastic.co/t/can-not-run-logstash-on-my-server/181715/4 "2019-05-19T22:33:31Z")

</div>

That is expected if you try to talk HTTP to a beats input. In the logstash log you are probably getting

```
io.netty.handler.codec.DecoderException: org.logstash.beats.BeatsParser$InvalidFrameProtocolException: Invalid Frame Type, received: 82

```

The beats input does not speak HTTP, it uses the lumberjack protocol.

When you start filebeat does it open a connection to logstash?

---

<div class="post-metadata">

**Author:** ![zenimagine](https://avatars.discourse-cdn.com/v4/letter/z/3bc359/32.png) [@zenimagine](https://discuss.elastic.co/u/zenimagine)\
**Post date:** [May 19, 2019, 10:58pm UTC](https://discuss.elastic.co/t/can-not-run-logstash-on-my-server/181715/5 "2019-05-19T22:58:37Z")

</div>

Logstash does not get the logs if I start Filebeat. How can I verify that the connection is open?

Port 5044 is open.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 19, 2019, 11:17pm UTC](https://discuss.elastic.co/t/can-not-run-logstash-on-my-server/181715/6 "2019-05-19T23:17:18Z")

</div>

Restart filebeat and a few seconds later run "netstat -an | grep 5044" at both ends.

---

<div class="post-metadata">

**Author:** ![zenimagine](https://avatars.discourse-cdn.com/v4/letter/z/3bc359/32.png) [@zenimagine](https://discuss.elastic.co/u/zenimagine)\
**Post date:** [May 19, 2019, 11:25pm UTC](https://discuss.elastic.co/t/can-not-run-logstash-on-my-server/181715/7 "2019-05-19T23:25:54Z")

</div>

on ELK server :

```
ubuntu@monitoring-example-com:~$ netstat -an | grep 5044
tcp6 0 0 :::5044 :::* LISTEN

```

,

```
ubuntu@monitoring-example-com:~$ sudo -u logstash /usr/share/logstash/bin/logstash --path.settings /etc/logstash -t
Sending Logstash logs to /var/log/logstash which is now configured via log4j2.properties
Configuration OK
[2019-05-20T01:28:46,536][INFO][logstash.runner] Using config.test_and_exit mode. Config Validation Result: OK. Exiting Logstash

```

On client server

```
ubuntu@www-example-com ~ $ sudo filebeat setup
Exiting: Index management requested but the Elasticsearch output is not configured/enabled
```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 19, 2019, 11:40pm UTC](https://discuss.elastic.co/t/can-not-run-logstash-on-my-server/181715/8 "2019-05-19T23:40:23Z")

</div>

When you restart filebeat, does 'netstat -an | grep 5044' show a connection, or a SYN\_SENT, or something else, or nothing?

---

<div class="post-metadata">

**Author:** ![zenimagine](https://avatars.discourse-cdn.com/v4/letter/z/3bc359/32.png) [@zenimagine](https://discuss.elastic.co/u/zenimagine)\
**Post date:** [May 19, 2019, 11:46pm UTC](https://discuss.elastic.co/t/can-not-run-logstash-on-my-server/181715/9 "2019-05-19T23:46:30Z")

</div>

It does not show anything

```
ubuntu@www-examle-com ~ $ netstat -an | grep 5044
ubuntu@www-example-com ~ $
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 16, 2019, 11:54pm UTC](https://discuss.elastic.co/t/can-not-run-logstash-on-my-server/181715/10 "2019-06-16T23:54:45Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.