# Doubt on Filebeat tcp input concept

**URL:** <https://discuss.elastic.co/t/doubt-on-filebeat-tcp-input-concept/202004>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [October 2, 2019, 4:19pm UTC](https://discuss.elastic.co/t/doubt-on-filebeat-tcp-input-concept/202004 "2019-10-02T16:19:02Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![NicoForce](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nicoforce/32/47036_2.png) [@NicoForce](https://discuss.elastic.co/u/NicoForce)\
**Post date:** [October 2, 2019, 4:19pm UTC](https://discuss.elastic.co/t/doubt-on-filebeat-tcp-input-concept/202004/1 "2019-10-02T16:19:03Z")

</div>

It's not quite clear to me from the docs how the tcp input works for filebeat, so I wanted to ask here.

I have the following filebeat.yaml.

```
filebeat.inputs:
- type: tcp
  host: "localhost:5044"

multiline.pattern: '^[[:space:]]+(at|\.{3})\b|^Caused by:'
multiline.negate: false
multiline.match: after

output.elasticsearch:
  hosts: ["http://elasticsearch:5000"]

```

**The part Im not sure about** is how the input by itself works, does it mean, filebeat is going to try and connect to localhost in the port 5044 and get the logs, or is it going to act as server and something else, like logback or an spring application is going to connect on the port 5044.

The documentation shows the following [concept](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-tcp.html#filebeat-input-tcp-tcp-host):

> #### host
> 
> The host and TCP port to listen on for event streams.

---

<div class="post-metadata">

**Author:** ![Andre\_Letterer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andre_letterer/32/42248_2.png) [@Andre\_Letterer](https://discuss.elastic.co/u/Andre_Letterer)\
**Post date:** [October 26, 2019, 8:33pm UTC](https://discuss.elastic.co/t/doubt-on-filebeat-tcp-input-concept/202004/2 "2019-10-26T20:33:09Z")

</div>

Hi Nicoforce,

welcome to our discuss board.  
Thank you for your question.

Now, to answer your question, filebeat act with as a server everything else is going to connect to port 5044. This is how it works.  
You can test that by for instance telnet or curl

```auto
curl -v localhost:5044
telnet localhost 5044

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 23, 2019, 8:33pm UTC](https://discuss.elastic.co/t/doubt-on-filebeat-tcp-input-concept/202004/3 "2019-11-23T20:33:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.