ERR Connecting error publishing events (retrying): dial tcp 127.0.0.1:5044: getsockopt: connection refused

[subhasmita_mishra]

ERROR pipeline/output.go:100 Failed to connect to backoff(async(tcp://localhost:5044)): dial tcp localhost:5044: connect: connection refused/etc

filebeat.yml file:
ilebeat.prospectors:
-
paths:
- /var/log/*.log
input_type: log
multiline.pattern: '^[0-9]{4}-[0-9]{2}-[0-9]{2}'
multiline.negate: true
multiline.match: after

output.logstash:
hosts: ["127.0.0.1:5044"]

logstash.yml
input {
file {
type => "test"
path => ["/var/log/.log"]
codec => multiline {
pattern => "^%{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{TIME}."
negate => "true"
what => "previous"
}
}
}

filter {
#If log line contains tab character followed by 'at' then we will tag that entry as stacktrace
if [message] =~ "\tat" {
grok {
match => ["message", "^(\tat)"]
add_tag => ["stacktrace"]
}
}

}

output {

stdout {
codec => rubydebug
}

Sending properly parsed log events to elasticsearch

elasticsearch {
hosts => ["localhost:9200"]
}
}

We tried to install logstash and filebeat in different vm and trying to stream logs .
Still it was not working.

Please share your input.

[jsoriano (Jaime Soriano)]

Hi @subhasmita_mishra and welcome,

The configuration you are using for filebeat seems similar to the one you have for logstash, are you trying to migrate from Logstash to filebeat?

If you had logstash in the same machine as filebeat, and you have moved it to another machine, you will need to update the output.logstash.hosts setting with the new address.