ERR Connecting error publishing events (retrying): dial tcp getsockopt: connection refused

ERROR pipeline/output.go:100 Failed to connect to backoff(async(tcp://localhost:5044)): dial tcp localhost:5044: connect: connection refused/etc

filebeat.yml file:
- /var/log/*.log
input_type: log
multiline.pattern: '^[0-9]{4}-[0-9]{2}-[0-9]{2}'
multiline.negate: true
multiline.match: after

hosts: [""]

input {
file {
type => "test"
path => ["/var/log/.log"]
codec => multiline {
pattern => "^%{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{TIME}.
negate => "true"
what => "previous"

filter {
#If log line contains tab character followed by 'at' then we will tag that entry as stacktrace
if [message] =~ "\tat" {
grok {
match => ["message", "^(\tat)"]
add_tag => ["stacktrace"]


output {

stdout {
codec => rubydebug

Sending properly parsed log events to elasticsearch

elasticsearch {
hosts => ["localhost:9200"]

We tried to install logstash and filebeat in different vm and trying to stream logs .
Still it was not working.

Please share your input.

Hi @subhasmita_mishra and welcome,

The configuration you are using for filebeat seems similar to the one you have for logstash, are you trying to migrate from Logstash to filebeat?

If you had logstash in the same machine as filebeat, and you have moved it to another machine, you will need to update the output.logstash.hosts setting with the new address.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.