I have setup latest bits of Elastic, Logstash, Kibana and Filebeat all on my local machine (OSX 10.12.3) and am getting a "Connection Refused" when filebeat tries to publish them. I have done a successful telnet when logstash is up which puzzles me. I am using the logstash.beat.config plugin to fire up logstash.
To start logstash
bin/logstash -f logstash-beats.conf
To start filebeat
sudo ./filebeat -e -c filebeat.yml -d "publish"
Here is some of my output
2017/05/12 21:13:26.267729 client.go:214: DBG Publish: {
"@timestamp": "2017-05-12T21:13:26.076Z",
"beat": {
"hostname": "dodegaard-MBA.local",
"name": "savm002",
"version": "5.4.0"
},
"input_type": "log",
"message": "04/05/2017 19:46:03 instance|044444444\tfetch_time|1.1006\ttotal_accounts|5\trt_accounts|0\trt_account_status|Current\trt_time_acct|\terror_data|\ttarget_url|\tuserlogon|",
"offset": 199086,
"source": "/users/dodegaard/documents/siteagentlogs_sample/0400_SD40040.log.04-05-2017",
"tags": [
"x002",
"legacy-tier"
],
"type": "log"
}
2017/05/12 21:13:26.267755 output.go:109: DBG output worker: publish 50 events
2017/05/12 21:13:26.284814 single.go:140: ERR Connecting error publishing events (retrying): Get http://127.0.0.1:5044: read tcp 127.0.0.1:58367->127.0.0.1:5044: read: connection reset by peer
2017/05/12 21:13:27.299930 single.go:140: ERR Connecting error publishing events (retrying): Get http://127.0.0.1:5044: read tcp 127.0.0.1:58368->127.0.0.1:5044: read: connection reset by peer
2017/05/12 21:13:29.306082 single.go:140: ERR Connecting error publishing events (retrying): Get http://127.0.0.1:5044: read tcp 127.0.0.1:58369->127.0.0.1:5044: read: connection reset by peer
2017/05/12 21:13:33.310978 single.go:140: ERR Connecting error publishing events (retrying): Get http://127.0.0.1:5044: read tcp 127.0.0.1:58370->127.0.0.1:5044: read: connection reset by peer
2017/05/12 21:13:41.316694 single.go:140: ERR Connecting error publishing events (retrying): Get http://127.0.0.1:5044: read tcp 127.0.0.1:58371->127.0.0.1:5044: read: connection reset by peer
2017/05/12 21:13:56.032021 metrics.go:39: INFO Non-zero metrics in the last 30s: filebeat.harvester.open_files=3 filebeat.harvester.running=3 filebeat.harvester.started=3 libbeat.es.publish.read_errors=5 libbeat.es.publish.write_bytes=605 libbeat.publisher.published_events=2045
2017/05/12 21:13:57.320940 single.go:140: ERR Connecting error publishing events (retrying): Get http://127.0.0.1:5044: read tcp 127.0.0.1:58375->127.0.0.1:5044: read: connection reset by peer
I am not interested in going directly to elasticsearch but want this to traffic through logstash.
Thank you so much in advance for your help.
d
