# ELK issue

**URL:** <https://discuss.elastic.co/t/elk-issue/105102>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [October 24, 2017, 4:41pm UTC](https://discuss.elastic.co/t/elk-issue/105102 "2017-10-24T16:41:41Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Rehan\_Ch](https://avatars.discourse-cdn.com/v4/letter/r/9f8e36/32.png) [@Rehan\_Ch](https://discuss.elastic.co/u/Rehan_Ch)\
**Post date:** [October 24, 2017, 4:41pm UTC](https://discuss.elastic.co/t/elk-issue/105102/1 "2017-10-24T16:41:41Z")

</div>

Hi,

I am new to ELK and configured ELK by following some online doc.  
I got the dashboard but my syslog or nginx access logs are not appearing in kibana.  
Here I am posting my config files.Please help

SSl certificate:

nano /etc/ssl/openssl.cnf  
subjectAltName = IP:192.168.57.128  
then I have generated certificate as mentioned in the link

> **[ELK Stack on Ubuntu 16.04 - Install ElasticSearch, Logstash, & Kibana](https://www.itzgeek.com/how-tos/linux/ubuntu-how-tos/setup-elk-stack-ubuntu-16-04.html)**
>
> ELK is a full featured data analytics stack, consists of Elasticsearch, Logstash, and Kibana, helps us to store and manage the logs in

logstash.conf

input {  
beats {  
port =\> 5044  
ssl =\> true  
ssl\_certificate =\> "/etc/ssl/logstash-forwarder.crt"  
ssl\_key =\> "/etc/ssl/logstash-forwarder.key"  
congestion\_threshold =\> "40"  
}  
}

filter {  
if [type] == "syslog" {  
grok {  
match =\> { "message" =\> "%{SYSLOGLINE}" }  
}

```
date {                                                         

```

match =\> ["timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]  
}  
}

}

output {  
elasticsearch {  
hosts =\> localhost  
index =\> "%{[@metadata][beat]}-%{+YYYY.MM.dd}"  
}  
stdout {  
codec =\> rubydebug  
}  
}

filebeat.yml

- input\_type: log

#-------------------------- Elasticsearch output ------------------------------  
#output.elasticsearch:

# Array of hosts to connect to.

#hosts: ["localhost:9200"]

# Optional protocol and basic auth credentials.

#protocol: "https"  
#username: "elastic"  
#password: "changeme"

output.logstash: outputs to use when sending the data collected by the beat.

# The Logstash hosts be used.

hosts: ["192.158.57.128:5044"]

# Optional SSL. By default is off.

# List of root certificates for HTTPS server verifications

ssl.certificate\_authorities: ["/etc/ssl/logstash-forwarder.crt"]

# Certificate for SSL client authentication

#ssl.certificate: "/etc/pki/client/cert.pem"

# Client Certificate Key

#ssl.key: "/etc/pki/client/cert.key"

#================================ Logging =====================================

# Sets log level. The default log level is info.

# Available log levels are: critical, error, warning, info, debug

logging.level: debug

filebeat log output in debug mode:

2017-10-24T09:39:20-07:00 DBG Check file for harvesting: /var/log/syslog  
2017-10-24T09:39:20-07:00 DBG Update existing file for harvesting: /var/log/syslog, offset: 1101851  
2017-10-24T09:39:20-07:00 DBG Harvester for file is still running: /var/log/syslog  
2017-10-24T09:39:20-07:00 DBG Check file for harvesting: /var/log/nginx/access.log  
2017-10-24T09:39:20-07:00 DBG Update existing file for harvesting: /var/log/nginx/access.log, offset: 10541  
2017-10-24T09:39:20-07:00 DBG Harvester for file is still running: /var/log/nginx/access.log  
2017-10-24T09:39:20-07:00 DBG Prospector states cleaned up. Before: 2, After: 2  
2017-10-24T09:39:24-07:00 ERR Connecting error publishing events (retrying): dial tcp 192.158.57.128:5044: getsockopt: connection refused  
2017-10-24T09:39:24-07:00 DBG send fail  
2017-10-24T09:39:30-07:00 INFO No non-zero metrics in the last 30s

Please help to rectify the issue.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [October 24, 2017, 5:10pm UTC](https://discuss.elastic.co/t/elk-issue/105102/2 "2017-10-24T17:10:30Z")

</div>

Please edit your post and use the `</>` button to format the config and logs, it will make it much easier for people to read and therefore assist with.

Also, FYI we’ve renamed ELK to the Elastic Stack, otherwise Beats feels left out 😉

Finally, is there anything in `stdout` from Logstash?

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [October 25, 2017, 11:54am UTC](https://discuss.elastic.co/t/elk-issue/105102/3 "2017-10-25T11:54:59Z")

</div>

Please properly format your post.

I'm seeing a 'connection refused' error. Is Logstash running/reachable?

Please checkout the [Filebeat Getting Started Guide](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-getting-started.html).

For your nginx use-case maybe have a look at [filebeat modules](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-modules.html) (Requires Filebeat, Elasticsearch and Kibana only).

Also check out [Securing Filebeat Communication docs](https://www.elastic.co/guide/en/beats/filebeat/current/securing-filebeat.html).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 22, 2017, 11:55am UTC](https://discuss.elastic.co/t/elk-issue/105102/4 "2017-11-22T11:55:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.