# Configuring logstash to listen to Filebeat

**URL:** <https://discuss.elastic.co/t/configuring-logstash-to-listen-to-filebeat/75160>\
**Category:** Logstash\
**Created:** [February 15, 2017, 8:49am UTC](https://discuss.elastic.co/t/configuring-logstash-to-listen-to-filebeat/75160 "2017-02-15T08:49:36Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![agrawalsaurabh](https://avatars.discourse-cdn.com/v4/letter/a/258eb7/32.png) [@agrawalsaurabh](https://discuss.elastic.co/u/agrawalsaurabh)\
**Post date:** [February 15, 2017, 8:49am UTC](https://discuss.elastic.co/t/configuring-logstash-to-listen-to-filebeat/75160/1 "2017-02-15T08:49:36Z")

</div>

Hi,

I have installed Logstash version 5.2.0 and File Beat 5.2.0. Next I configured file beat to send events to logstash.

Next I configured logstash to listen to file beat by the following configuration:

> input {  
> beats {  
> port =\> 5044  
> }  
> }

> output {  
> elasticsearch {  
> hosts =\> "localhost:9200"  
> manage\_template =\> false  
> index =\> "%{[@metadata][beat]}-%{+YYYY.MM.dd}"  
> document\_type =\> "%{[@metadata][type]}"  
> }  
> }

The Elasticsearch document asks to install input beats plugin for logstash. So i executed the following command but it says connection refused.

> D:\Softwares\LogMonitoring\logstash-5.2.0\bin\>logstash-plugin install logstash-i  
> nput-beats  
> ERROR: Something went wrong when installing logstash-input-beats, message: Conne  
> ction refused - Connection refused

Can someone point to the correct steps to configure logstash to received inputs from file beat?

I am trying to parse the log files from apache and push it to elasticsearch.

Thanks.  
Saurabh

---

<div class="post-metadata">

**Author:** ![guyboertje](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/guyboertje/32/31592_2.png) [@guyboertje](https://discuss.elastic.co/u/guyboertje)\
**Post date:** [February 15, 2017, 10:02am UTC](https://discuss.elastic.co/t/configuring-logstash-to-listen-to-filebeat/75160/2 "2017-02-15T10:02:33Z")

</div>

The beats input is sooooo important in the Elastic Stack it is always shipped with each Logstash release.

```auto
bin/logstash-plugin list --verbose logstash-input-beats
logstash-input-beats (3.1.12)

bin/logstash-plugin --help
Usage:
    bin/logstash-plugin [OPTIONS] SUBCOMMAND [ARG] ...

Parameters:
    SUBCOMMAND subcommand
    [ARG] ... subcommand arguments

Subcommands:
    list List all installed Logstash plugins
    install Install a Logstash plugin
    remove Remove a Logstash plugin
    update Update a plugin
    pack Package currently installed plugins, Deprecated: Please use prepare-offline-pack instead
    unpack Unpack packaged plugins, Deprecated: Please use prepare-offline-pack instead
    generate Create the foundation for a new plugin
    uninstall Uninstall a plugin. Deprecated: Please use remove instead
    prepare-offline-pack Create an archive of specified plugins to use for offline installation

Options:
    -h, --help print help

$ bin/logstash-plugin list --help
Usage:
    bin/logstash-plugin list [OPTIONS] [PLUGIN]

Parameters:
    [PLUGIN] Part of plugin name to search for, leave empty for all plugins

Options:
    --installed List only explicitly installed plugins using bin/logstash-plugin install ... (default: false)
    --verbose Also show plugin version number (default: false)
    --group NAME Filter plugins per group: input, output, filter or codec
    -h, --help print help

```

---

<div class="post-metadata">

**Author:** ![agrawalsaurabh](https://avatars.discourse-cdn.com/v4/letter/a/258eb7/32.png) [@agrawalsaurabh](https://discuss.elastic.co/u/agrawalsaurabh)\
**Post date:** [February 15, 2017, 10:26am UTC](https://discuss.elastic.co/t/configuring-logstash-to-listen-to-filebeat/75160/3 "2017-02-15T10:26:10Z")

</div>

Thanks a lot for your reply. I just checked and the beats plugin is shipped by default with 5.2.

Thank.  
Saurabh

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 15, 2017, 10:26am UTC](https://discuss.elastic.co/t/configuring-logstash-to-listen-to-filebeat/75160/4 "2017-03-15T10:26:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.