Data not coming in to Logstash


(Micke) #1

Hi,
Have tried both winlogbeat and filebeat, get same problem.

I have configured an ELK-server that works just fine locally, now i am trying to send events from a remote server with winlogbeat or filebeat and the events will not be recieved.

Get this in the winlogbeat-agent:
ERR Connecting error publishing events (retrying): dial tcp 192.168.1.1:5044: connectex: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection
failed because connected host has failed to respond.

Winlogbeat config:
winlogbeat.event_logs:
- name: Security
output.logstash:
hosts: ["192.168.1.1:5044"]

filebeat config:
- input_type: log
- C:\Temp*.log
output.logstash:
hosts: ["192.168.1.1:5044"]

This is the logstash input config:
input {
beats {
port => 5044
type => "log"
}
}

The firewall is open

Installed beat agent
Configured the config file as above
Started Service

Have working agents locally on ELK-server that works fine (index created for both filebeat and winlogbeat)

(Running ELK on a windows machine)

Do the filebeat service need to run as a windows service account, or should it work as local system?
Do i need to configure Logstash to allow remote Connections?

Got stuck.. :frowning:


(Micke) #2

This was because our network technicians, dont ever trust them :slight_smile:


(Vishal Sharma) #3

Lulz...


(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.