Dial tcp (ip number):5044: getsockopt: connection refused


I am trying to transfer logs from filebeats to logstash, but I get this error in the filebeats log:

dial tcp (ip number):5044: getsockopt: connection refused

In my LogStash config.d the configuration file is: and the content is:

  input {
  beats {
    port => 5044
output {
  elasticsearch {
    hosts => "(ipnumber):9200"
    manage_template => false
    index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
    document_type => "%{[@metadata][type]}"

My filebeat configuration is:

#----------------------------- Logstash output --------------------------------
  # The Logstash hosts
  hosts: ["(ipnumber):5044"]
  index: filebeat
  # Optional SSL. By default is off.
  # List of root certificates for HTTPS server verifications
  #ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]

  # Certificate for SSL client authentication
  #ssl.certificate: "/etc/pki/client/cert.pem"

  # Client Certificate Key
  #ssl.key: "/etc/pki/client/cert.key"

As mentioned in here I checked and there is no more configuration files in conf.d
As mentioned in here I did not specify the ip number

Many thanks!

Are you able to telnet to port 5044 on the Logstash machine from the one where Filebeat is running?

Hey Christian, They are actually sitting on the same VM

Does it work if you change the IP to localhost?

No the error is constant also then. I get still:

dial tcp getsockopt: connection refused

When I connect the filebeat straight to the ES there is a connection

Is this possible because I dont have the beats plugin? If so I am using 5.2, and as far as I know version 5.2 does not use plugins, and how can i install this?

Is logstash running? Have you tried telnet localhost 5044?

Hi steffends,

Well I tried to do telnet and it did not turn out good :slight_smile: .
When I try ping it does work, how can this be?

is logstash running?

Hi @steffens,

Thank you for all the help, I succeeded by installing Logstash on a diff. VM.

From some reason when they were running on the same machine they did not work (yes also Logstash was running)

1 Like

Which OS have you been using?

This topic was automatically closed after 21 days. New replies are no longer allowed.