Have tried both winlogbeat and filebeat, get same problem.
I have configured an ELK-server that works just fine locally, now i am trying to send events from a remote server with winlogbeat or filebeat and the events will not be recieved.
Get this in the winlogbeat-agent:
ERR Connecting error publishing events (retrying): dial tcp 192.168.1.1:5044: connectex: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection
failed because connected host has failed to respond.
- name: Security
- input_type: log
This is the logstash input config:
port => 5044
type => "log"
The firewall is open
Installed beat agent
Configured the config file as above
Have working agents locally on ELK-server that works fine (index created for both filebeat and winlogbeat)
(Running ELK on a windows machine)
Do the filebeat service need to run as a windows service account, or should it work as local system?
Do i need to configure Logstash to allow remote Connections?