Data not coming in to Logstash

(Micke) #1

Have tried both winlogbeat and filebeat, get same problem.

I have configured an ELK-server that works just fine locally, now i am trying to send events from a remote server with winlogbeat or filebeat and the events will not be recieved.

Get this in the winlogbeat-agent:
ERR Connecting error publishing events (retrying): dial tcp connectex: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection
failed because connected host has failed to respond.

Winlogbeat config:
- name: Security
hosts: [""]

filebeat config:
- input_type: log
- C:\Temp*.log
hosts: [""]

This is the logstash input config:
input {
beats {
port => 5044
type => "log"

The firewall is open

Installed beat agent
Configured the config file as above
Started Service

Have working agents locally on ELK-server that works fine (index created for both filebeat and winlogbeat)

(Running ELK on a windows machine)

Do the filebeat service need to run as a windows service account, or should it work as local system?
Do i need to configure Logstash to allow remote Connections?

Got stuck.. :frowning:

(Micke) #2

This was because our network technicians, dont ever trust them :slight_smile:

(Vishal Sharma) #3


(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.