Doubt on Filebeat tcp input concept

Elastic Stack Beats
1

It's not quite clear to me from the docs how the tcp input works for filebeat, so I wanted to ask here.

I have the following filebeat.yaml.

filebeat.inputs:
- type: tcp
  host: "localhost:5044"

multiline.pattern: '^[[:space:]]+(at|\.{3})\b|^Caused by:'
multiline.negate: false
multiline.match: after

output.elasticsearch:
  hosts: ["http://elasticsearch:5000"]

The part Im not sure about is how the input by itself works, does it mean, filebeat is going to try and connect to localhost in the port 5044 and get the logs, or is it going to act as server and something else, like logback or an spring application is going to connect on the port 5044.

The documentation shows the following concept:

host

The host and TCP port to listen on for event streams.

2

Hi Nicoforce,

welcome to our discuss board.
Thank you for your question.

Now, to answer your question, filebeat act with as a server everything else is going to connect to port 5044. This is how it works.
You can test that by for instance telnet or curl

curl -v localhost:5044
telnet localhost 5044
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.