hi . im trying to send sysmon logs via logstash and there is no data getin ,
these are my logs error:
{"log.level":"error","@timestamp":"2022-12-18T08:15:16.318Z","log.logger":"publisher_pipeline_output","log.origin":{"file.name":"pipeline/client_worker.go","file.line":150},"message":"Failed to connect to failover(backoff(async(tcp://ameli-hafia:5000)),backoff(async(tcp://ameli-hafifa2:5000)),backoff(async(tcp://ameli-hafifa3:5000))): dial tcp 172.20.0.21:5000: connectex: No connection could be made because the target machine actively refused it.","service.name":"winlogbeat","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2022-12-18T08:15:19.866Z","log.logger":"publisher_pipeline_output","log.origin":{"file.name":"pipeline/client_worker.go","file.line":150},"message":"Failed to connect to failover(backoff(async(tcp://ameli-hafia:5000)),backoff(async(tcp://ameli-hafifa2:5000)),backoff(async(tcp://ameli-hafifa3:5000))): dial tcp 172.20.0.22:5000: connectex: No connection could be made because the target machine actively refused it.","service.name":"winlogbeat","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2022-12-18T08:15:24.100Z","log.logger":"publisher_pipeline_output","log.origin":{"file.name":"pipeline/client_worker.go","file.line":150},"message":"Failed to connect to failover(backoff(async(tcp://ameli-hafia:5000)),backoff(async(tcp://ameli-hafifa2:5000)),backoff(async(tcp://ameli-hafifa3:5000))): dial tcp 172.20.0.21:5000: connectex: No connection could be made because the target machine actively refused it.","service.name":"winlogbeat","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2022-12-18T08:15:24.366Z","log.logger":"logstash","log.origin":{"file.name":"logstash/async.go","file.line":280},"message":"Failed to publish events caused by: read tcp 172.20.0.23:50539->172.20.0.20:5000: wsarecv: An established connection was aborted by the software in your host machine.","service.name":"winlogbeat","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2022-12-18T08:15:24.439Z","log.logger":"logstash","log.origin":{"file.name":"logstash/async.go","file.line":280},"message":"Failed to publish events caused by: client is not connected","service.name":"winlogbeat","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2022-12-18T08:15:26.203Z","log.logger":"publisher_pipeline_output","log.origin":{"file.name":"pipeline/client_worker.go","file.line":176},"message":"failed to publish events: client is not connected","service.name":"winlogbeat","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2022-12-18T08:15:31.552Z","log.logger":"publisher_pipeline_output","log.origin":{"file.name":"pipeline/client_worker.go","file.line":150},"message":"Failed to connect to failover(backoff(async(tcp://ameli-hafia:5000)),backoff(async(tcp://ameli-hafifa2:5000)),backoff(async(tcp://ameli-hafifa3:5000))): dial tcp 172.20.0.22:5000: connectex: No connection could be made because the target machine actively refused it.","service.name":"winlogbeat","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2022-12-18T08:15:38.831Z","log.logger":"publisher_pipeline_output","log.origin":{"file.name":"pipeline/client_worker.go","file.line":150},"message":"Failed to connect to failover(backoff(async(tcp://ameli-hafia:5000)),backoff(async(tcp://ameli-hafifa2:5000)),backoff(async(tcp://ameli-hafifa3:5000))): dial tcp 172.20.0.21:5000: connectex: No connection could be made because the target machine actively refused it.","service.name":"winlogbeat","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2022-12-18T08:15:38.908Z","log.logger":"logstash","log.origin":{"file.name":"logstash/async.go","file.line":280},"message":"Failed to publish events caused by: read tcp 172.20.0.23:50545->172.20.0.20:5000: wsarecv: An established connection was aborted by the software in your host machine.","service.name":"winlogbeat","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2022-12-18T08:15:38.913Z","log.logger":"logstash","log.origin":{"file.name":"logstash/async.go","file.line":280},"message":"Failed to publish events caused by: client is not connected","service.name":"winlogbeat","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2022-12-18T08:15:40.305Z","log.logger":"publisher_pipeline_output","log.origin":{"file.name":"pipeline/client_worker.go","file.line":176},"message":"failed to publish events: client is not connected","service.name":"winlogbeat","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2022-12-18T08:15:47.481Z","log.logger":"publisher_pipeline_output","log.origin":{"file.name":"pipeline/client_worker.go","file.line":150},"message":"Failed to connect to failover(backoff(async(tcp://ameli-hafia:5000)),backoff(async(tcp://ameli-hafifa2:5000)),backoff(async(tcp://ameli-hafifa3:5000))): dial tcp 172.20.0.22:5000: connectex: No connection could be made because the target machine actively refused it.","service.name":"winlogbeat","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2022-12-18T08:15:47.590Z","log.logger":"logstash","log.origin":{"file.name":"logstash/async.go","file.line":280},"message":"Failed to publish events caused by: read tcp 172.20.0.23:50547->172.20.0.20:5000: wsarecv: An established connection was aborted by the software in your host machine.","service.name":"winlogbeat","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2022-12-18T08:15:47.610Z","log.logger":"logstash","log.origin":{"file.name":"logstash/async.go","file.line":280},"message":"Failed to publish events caused by: client is not connected","service.name":"winlogbeat","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2022-12-18T08:15:49.470Z","log.logger":"publisher_pipeline_output","log.origin":{"file.name":"pipeline/client_worker.go","file.line":176},"message":"failed to publish events: client is not connected","service.name":"winlogbeat","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2022-12-18T08:16:07.248Z","log.logger":"publisher_pipeline_output","log.origin":{"file.name":"pipeline/client_worker.go","file.line":150},"message":"Failed to connect to failover(backoff(async(tcp://ameli-hafia:5000)),backoff(async(tcp://ameli-hafifa2:5000)),backoff(async(tcp://ameli-hafifa3:5000))): dial tcp 172.20.0.22:5000: connectex: No connection could be made because the target machine actively refused it.","service.name":"winlogbeat","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2022-12-18T08:16:22.950Z","log.logger":"publisher_pipeline_output","log.origin":{"file.name":"pipeline/client_worker.go","file.line":150},"message":"Failed to connect to failover(backoff(async(tcp://ameli-hafia:5000)),backoff(async(tcp://ameli-hafifa2:5000)),backoff(async(tcp://ameli-hafifa3:5000))): dial tcp 172.20.0.21:5000: connectex: No connection could be made because the target machine actively refused it.","service.name":"winlogbeat","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2022-12-18T08:16:42.462Z","log.logger":"publisher_pipeline_output","log.origin":{"file.name":"pipeline/client_worker.go","file.line":150},"message":"Failed to connect to failover(backoff(async(tcp://ameli-hafia:5000)),backoff(async(tcp://ameli-hafifa2:5000)),backoff(async(tcp://ameli-hafifa3:5000))): dial tcp 172.20.0.22:5000: connectex: No connection could be made because the target machine actively refused it.","service.name":"winlogbeat","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2022-12-18T08:17:15.433Z","log.logger":"publisher_pipeline_output","log.origin":{"file.name":"pipeline/client_worker.go","file.line":150},"message":"Failed to connect to failover(backoff(async(tcp://ameli-hafia:5000)),backoff(async(tcp://ameli-hafifa2:5000)),backoff(async(tcp://ameli-hafifa3:5000))): dial tcp 172.20.0.21:5000: connectex: No connection could be made because the target machine actively refused it.","service.name":"winlogbeat","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2022-12-18T08:17:49.065Z","log.logger":"publisher_pipeline_output","log.origin":{"file.name":"pipeline/client_worker.go","file.line":150},"message":"Failed to connect to failover(backoff(async(tcp://ameli-hafia:5000)),backoff(async(tcp://ameli-hafifa2:5000)),backoff(async(tcp://ameli-hafifa3:5000))): dial tcp 172.20.0.22:5000: connectex: No connection could be made because the target machine actively refused it.","service.name":"winlogbeat","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2022-12-18T08:18:42.176Z","log.logger":"publisher_pipeline_output","log.origin":{"file.name":"pipeline/client_worker.go","file.line":150},"message":"Failed to connect to failover(backoff(async(tcp://ameli-hafia:5000)),backoff(async(tcp://ameli-hafifa2:5000)),backoff(async(tcp://ameli-hafifa3:5000))): dial tcp 172.20.0.21:5000: connectex: No connection could be made because the target machine actively refused it.","service.name":"winlogbeat","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2022-12-18T08:19:43.458Z","log.logger":"publisher_pipeline_output","log.origin":{"file.name":"pipeline/client_worker.go","file.line":150},"message":"Failed to connect to failover(backoff(async(tcp://ameli-hafia:5000)),backoff(async(tcp://ameli-hafifa2:5000)),backoff(async(tcp://ameli-hafifa3:5000))): dial tcp 172.20.0.22:5000: connectex: No connection could be made because the target machine actively refused it.","service.name":"winlogbeat","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2022-12-18T08:19:43.537Z","log.logger":"logstash","log.origin":{"file.name":"logstash/async.go","file.line":280},"message":"Failed to publish events caused by: read tcp 172.20.0.23:50582->172.20.0.20:5000: wsarecv: An established connection was aborted by the software in your host machine.","service.name":"winlogbeat","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2022-12-18T08:19:43.548Z","log.logger":"logstash","log.origin":{"file.name":"logstash/async.go","file.line":280},"message":"Failed to publish events caused by: client is not connected","service.name":"winlogbeat","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2022-12-18T08:19:45.126Z","log.logger":"publisher_pipeline_output","log.origin":{"file.name":"pipeline/client_worker.go","file.line":176},"message":"failed to publish events: client is not connected","service.name":"winlogbeat","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2022-12-18T08:20:21.260Z","log.logger":"publisher_pipeline_output","log.origin":{"file.name":"pipeline/client_worker.go","file.line":150},"message":"Failed to connect to failover(backoff(async(tcp://ameli-hafia:5000)),backoff(async(tcp://ameli-hafifa2:5000)),backoff(async(tcp://ameli-hafifa3:5000))): dial tcp 172.20.0.22:5000: connectex: No connection could be made because the target machine actively refused it.","service.name":"winlogbeat","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2022-12-18T08:20:21.341Z","log.logger":"logstash","log.origin":{"file.name":"logstash/async.go","file.line":280},"message":"Failed to publish events caused by: read tcp 172.20.0.23:50587->172.20.0.20:5000: wsarecv: An established connection was aborted by the software in your host machine.","service.name":"winlogbeat","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2022-12-18T08:20:21.346Z","log.logger":"logstash","log.origin":{"file.name":"logstash/async.go","file.line":280},"message":"Failed to publish events caused by: client is not connected","service.name":"winlogbeat","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2022-12-18T08:20:22.678Z","log.logger":"publisher_pipeline_output","log.origin":{"file.name":"pipeline/client_worker.go","file.line":176},"message":"failed to publish events: client is not connected","service.name":"winlogbeat","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2022-12-18T08:20:58.525Z","log.logger":"publisher_pipeline_output","log.origin":{"file.name":"pipeline/client_worker.go","file.line":150},"message":"Failed to connect to failover(backoff(async(tcp://ameli-hafia:5000)),backoff(async(tcp://ameli-hafifa2:5000)),backoff(async(tcp://ameli-hafifa3:5000))): dial tcp 172.20.0.21:5000: connectex: No connection could be made because the target machine actively refused it.","service.name":"winlogbeat","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2022-12-18T08:20:58.603Z","log.logger":"logstash","log.origin":{"file.name":"logstash/async.go","file.line":280},"message":"Failed to publish events caused by: read tcp 172.20.0.23:50594->172.20.0.20:5000: wsarecv: An established connection was aborted by the software in your host machine.","service.name":"winlogbeat","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2022-12-18T08:20:58.618Z","log.logger":"logstash","log.origin":{"file.name":"logstash/async.go","file.line":280},"message":"Failed to publish events caused by: client is not connected","service.name":"winlogbeat","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2022-12-18T08:20:59.923Z","log.logger":"publisher_pipeline_output","log.origin":{"file.name":"pipeline/client_worker.go","file.line":176},"message":"failed to publish events: client is not connected","service.name":"winlogbeat","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2022-12-18T08:21:42.773Z","log.logger":"publisher_pipeline_output","log.origin":{"file.name":"pipeline/client_worker.go","file.line":150},"message":"Failed to connect to failover(backoff(async(tcp://ameli-hafia:5000)),backoff(async(tcp://ameli-hafifa2:5000)),backoff(async(tcp://ameli-hafifa3:5000))): dial tcp 172.20.0.21:5000: connectex: No connection could be made because the target machine actively refused it.","service.name":"winlogbeat","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2022-12-
Is a firewall active and opened the port 5000 on the host .21?
hi , you want me to send you my winlogbeat.yml configuration? there is no firewall active or open port
hi , you want me to send you my winlogbeat configuration?
בתאריך יום א׳, 18 בדצמ׳ 2022 ב-2:23 מאת Rios via Discuss the Elastic Stack <notifications@elastic.discoursemail.com>:
You need to share your configs, both your winlogbeat.yml and your logstash pipeline.
Also, please format your post using the preformatted text, the </> button, it is pretty hard to read the log you shared without the proper formatting, always share configs and logs using that option.
From what you shared you have a network error, your winlogbeat can not access the configured output, you need to troubleshot this to find what is the issue.
can you send me your mail that i will send you my winlogbeat.yml config?
I cannot, share the files here in the topic so more people can see it and maybe help you solve your issue.