Hi,
Have tried both winlogbeat and filebeat, get same problem.
I have configured an ELK-server that works just fine locally, now i am trying to send events from a remote server with winlogbeat or filebeat and the events will not be recieved.
Get this in the winlogbeat-agent:
ERR Connecting error publishing events (retrying): dial tcp 192.168.1.1:5044: connectex: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection
failed because connected host has failed to respond.
Winlogbeat config:
winlogbeat.event_logs:
- name: Security
output.logstash:
hosts: ["192.168.1.1:5044"]
filebeat config:
- input_type: log
- C:\Temp*.log
output.logstash:
hosts: ["192.168.1.1:5044"]
This is the logstash input config:
input {
beats {
port => 5044
type => "log"
}
}
The firewall is open
Installed beat agent
Configured the config file as above
Started Service
Have working agents locally on ELK-server that works fine (index created for both filebeat and winlogbeat)
(Running ELK on a windows machine)
Do the filebeat service need to run as a windows service account, or should it work as local system?
Do i need to configure Logstash to allow remote Connections?
Got stuck.. 
