Doubt on Filebeat tcp input concept

[NicoForce (Cristian Cordova)]

It's not quite clear to me from the docs how the tcp input works for filebeat, so I wanted to ask here.

I have the following filebeat.yaml.

filebeat.inputs:
- type: tcp
  host: "localhost:5044"

multiline.pattern: '^[[:space:]]+(at|\.{3})\b|^Caused by:'
multiline.negate: false
multiline.match: after

output.elasticsearch:
  hosts: ["http://elasticsearch:5000"]

The part Im not sure about is how the input by itself works, does it mean, filebeat is going to try and connect to localhost in the port 5044 and get the logs, or is it going to act as server and something else, like logback or an spring application is going to connect on the port 5044.

The documentation shows the following concept:

host

The host and TCP port to listen on for event streams.

[Andre_Letterer (André Letterer)]

Hi Nicoforce,

welcome to our discuss board.
Thank you for your question.

Now, to answer your question, filebeat act with as a server everything else is going to connect to port 5044. This is how it works.
You can test that by for instance telnet or curl

curl -v localhost:5044
telnet localhost 5044