ELK+FileBeat

[vijaygn1990 (VIJAY KUMAR)]

I have been trying to set a ELK stack with file beat installed on all my cluster. Here my config is I am using my PC(host1) as ELK server with file beat agent installed to monitor logs. I have other PC which has installed file beat configured(host2) to send output to logstash on host1. The file beat on host1 is able to send output to logstash on host1 and seen on kibana. But other remote server(host2) cannot hit my logstash on host1 and also cannot be ssen on Kibana. The host2 is getting

output.go:74: ERR Failed to connect: Get http://xxxx:9200: dial tcp xxx:9200: connectex: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond.

Please help to point the issue

[magnusbaeck (Magnus Bäck)]

You have configured Filebeat on host2 to connect to Elasticsearch. If that's not what you want to do you need to disable that configuration.

[vijaygn1990 (VIJAY KUMAR)]

Thank you magnusbaeck for getting back. In the host2, filebeat is configured to output to logstash server running on host1. And also elastic search is disabled in filebeat configuration in host2.

[magnusbaeck (Magnus Bäck)]

And also Elasticsearch is disabled in filebeat configuration in host2.

Well apparently not since Filebeat in fact is attempting to connect to Elasticsearch, right? What does your Filebeat configuration look like? Make sure you format the file as preformatted text so that all indentation is preserved.