# Connection not established between logstash and filebeat

**URL:** <https://discuss.elastic.co/t/connection-not-established-between-logstash-and-filebeat/42168>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [February 18, 2016, 5:28pm UTC](https://discuss.elastic.co/t/connection-not-established-between-logstash-and-filebeat/42168 "2016-02-18T17:28:04Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![Akash\_Katakam](https://avatars.discourse-cdn.com/v4/letter/a/e68b1a/32.png) [@Akash\_Katakam](https://discuss.elastic.co/u/Akash_Katakam)\
**Post date:** [February 18, 2016, 5:28pm UTC](https://discuss.elastic.co/t/connection-not-established-between-logstash-and-filebeat/42168/1 "2016-02-18T17:28:04Z")

</div>

FIlebeat running on ubuntu 14.04  
Elk is installed in windows 2008 server

Logs are in ubuntu machine and i want to send my remote machine.  
my filebeat config and logstash configs are attached.

```auto
input {
  beats {
    port => 5043
    type => "logs"
  }
}

output {
  elasticsearch {
    hosts => "localhost:9200"
    index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
    document_type => "%{[@metadata][type]}"
  }
}

```

filebeat:

```auto
  prospectors:
      paths:
        - /var/lib/tomcat7/logs/storypulse.log
      input_type: log
output:
  logstash:
    # The Logstash hosts
    hosts: ["98.175.99.177:5043"]
    # Number of workers per Logstash host.
    worker: 1 
shipper: 
  refresh_topology_freq: 10 
logging:
  files:
    rotateeverybytes: 10485760 # = 10MB

```

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [February 18, 2016, 6:05pm UTC](https://discuss.elastic.co/t/connection-not-established-between-logstash-and-filebeat/42168/2 "2016-02-18T18:05:58Z")

</div>

The filebeat config looks off.

1. yaml is sensitive to indendation. make sure to use spaces for indentation only
2. `prospectors` expects a list of configs all beginning with `-`

---

<div class="post-metadata">

**Author:** ![Akash\_Katakam](https://avatars.discourse-cdn.com/v4/letter/a/e68b1a/32.png) [@Akash\_Katakam](https://discuss.elastic.co/u/Akash_Katakam)\
**Post date:** [February 19, 2016, 7:00am UTC](https://discuss.elastic.co/t/connection-not-established-between-logstash-and-filebeat/42168/3 "2016-02-19T07:00:49Z")

</div>

filebeat is running fine i tried debugging it.

> [@steffens](#):
>
> prospectors expects a list of configs all beginning with -

I didnt understand what does this mean. Can please explain in layman terms.

This is the debug output.

 ![](https://us1.discourse-cdn.com/elastic/original/2X/2/2feb424768526401fc64fdd03da8c161964979b9.PNG)

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [February 19, 2016, 5:33pm UTC](https://discuss.elastic.co/t/connection-not-established-between-logstash-and-filebeat/42168/4 "2016-02-19T17:33:26Z")

</div>

See this post: [Filebeat only reporting on last prospector](https://discuss.elastic.co/t/filebeat-only-reporting-on-last-prospector/41237/2)

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [February 19, 2016, 5:33pm UTC](https://discuss.elastic.co/t/connection-not-established-between-logstash-and-filebeat/42168/5 "2016-02-19T17:33:35Z")

</div>

from docs:

```auto
filebeat:
  prospectors:
    -
      paths:
        - /var/log/system.log
        - /var/log/wifi.log
    -
      paths:
        - "/var/log/apache2/*"

```

multiple prospectors are defined each starting with `-`

---

<div class="post-metadata">

**Author:** ![Akash\_Katakam](https://avatars.discourse-cdn.com/v4/letter/a/e68b1a/32.png) [@Akash\_Katakam](https://discuss.elastic.co/u/Akash_Katakam)\
**Post date:** [February 19, 2016, 5:59pm UTC](https://discuss.elastic.co/t/connection-not-established-between-logstash-and-filebeat/42168/6 "2016-02-19T17:59:38Z")

</div>

connecting error publishing events retrying:dail tcp [98.xx.xx.xxx:5043](http://98.xx.xx.xxx:5043) i/o timeout send fail how can i overcome this?

some times in filebeat we can see data that is no the problem the data that is shown during debug of filebeat is not visible in my ES

---

<div class="post-metadata">

**Author:** ![Akash\_Katakam](https://avatars.discourse-cdn.com/v4/letter/a/e68b1a/32.png) [@Akash\_Katakam](https://discuss.elastic.co/u/Akash_Katakam)\
**Post date:** [February 19, 2016, 7:55pm UTC](https://discuss.elastic.co/t/connection-not-established-between-logstash-and-filebeat/42168/7 "2016-02-19T19:55:44Z")

</div>

Thanks for commenting we got it working. We just opened the port 5043 in the firewall and its working now.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 9:55pm UTC](https://discuss.elastic.co/t/connection-not-established-between-logstash-and-filebeat/42168/8 "2017-07-05T21:55:30Z")

</div>