# ERR Connecting error publishing events (retrying): dial tcp 127.0.0.1:5044: getsockopt: connection refused

**URL:** https://discuss.elastic.co/t/err-connecting-error-publishing-events-retrying-dial-tcp-127-0-0-1-getsockopt-connection-refused/196933
**Category:** Beats
**Tags:** filebeat
**Created:** [August 27, 2019, 10:54am UTC](https://discuss.elastic.co/t/err-connecting-error-publishing-events-retrying-dial-tcp-127-0-0-1-getsockopt-connection-refused/196933 "2019-08-27T10:54:27Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![subhasmita\_mishra](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/subhasmita_mishra/32/51379_2.png) [@subhasmita\_mishra](https://discuss.elastic.co/u/subhasmita_mishra)
#### Post date: [August 27, 2019, 10:54am UTC](https://discuss.elastic.co/t/err-connecting-error-publishing-events-retrying-dial-tcp-127-0-0-1-getsockopt-connection-refused/196933/1 "2019-08-27T10:54:27Z")

</div>

ERROR pipeline/output.go:100 Failed to connect to backoff(async(tcp://localhost:5044)): dial tcp localhost:5044: connect: connection refused/etc

filebeat.yml file:  
ilebeat.prospectors:  
-  
paths:  
- /var/log/\*.log  
input\_type: log  
multiline.pattern: '^[0-9]{4}-[0-9]{2}-[0-9]{2}'  
multiline.negate: true  
multiline.match: after

output.logstash:  
hosts: ["127.0.0.1:5044"]

logstash.yml  
input {  
file {  
type =\> "test"  
path =\> ["/var/log/_.log"]  
codec =\> multiline {  
pattern =\> "^%{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{TIME}._"  
negate =\> "true"  
what =\> "previous"  
}  
}  
}

filter {  
#If log line contains tab character followed by 'at' then we will tag that entry as stacktrace  
if [message] =~ "\tat" {  
grok {  
match =\> ["message", "^(\tat)"]  
add\_tag =\> ["stacktrace"]  
}  
}

}

output {

stdout {  
codec =\> rubydebug  
}

# Sending properly parsed log events to elasticsearch

elasticsearch {  
hosts =\> ["localhost:9200"]  
}  
}

We tried to install logstash and filebeat in different vm and trying to stream logs .  
Still it was not working.

Please share your input.

---

<div class="post-metadata">

### Author: ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)
#### Post date: [August 27, 2019, 5:38pm UTC](https://discuss.elastic.co/t/err-connecting-error-publishing-events-retrying-dial-tcp-127-0-0-1-getsockopt-connection-refused/196933/2 "2019-08-27T17:38:37Z")

</div>

Hi @subhasmita_mishra and welcome,

The configuration you are using for filebeat seems similar to the one you have for logstash, are you trying to migrate from Logstash to filebeat?

If you had logstash in the same machine as filebeat, and you have moved it to another machine, you will need to update the `output.logstash.hosts` setting with the new address.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 24, 2019, 5:38pm UTC](https://discuss.elastic.co/t/err-connecting-error-publishing-events-retrying-dial-tcp-127-0-0-1-getsockopt-connection-refused/196933/3 "2019-09-24T17:38:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.