Hi there!
I'm trying to send logs with filebeat to remote logstash host but receive the error on each attempt of filebeat to push to remote logstash host. Both hosts are running on linux. The logstash is up on remote host. But nevertheless:
single.go:140: ERR Connecting error publishing events (retrying): dial tcp {remote.logstash.host.ip}:5044: getsockopt: no route to host
I have a source host where filebeat is running . Here's its config:
#=========================== Filebeat prospectors =============================
filebeat.prospectors:
- input_type: log
# Paths that should be crawled and fetched. Glob based paths.
paths:
- /var/log/messages
#================================ General =====================================
# The name of the shipper that publishes the network data. It can be used to group
# all the transactions sent by a single shipper in the web interface.
#name:
# The tags of the shipper are included in their own field with each
# transaction published.
tags: ["filebeat", "testing"]
#================================ Outputs =====================================
# Configure what outputs to use when sending the data collected by the beat.
# Multiple outputs may be used.
#-------------------------- Elasticsearch output ------------------------------
output.elasticsearch:
enabled: false
# Array of hosts to connect to.
hosts: ["remote.elastic.host.ip:9200"]
# Optional protocol and basic auth credentials.
#protocol: "https"
#username: "elastic"
#password: "changeme"
#----------------------------- Logstash output --------------------------------
output.logstash:
enabled: true
# The Logstash hosts
hosts: ["remote.logstash.host.ip:5044"]
console:
pretty: true
#================================ Logging =====================================
# Sets log level. The default log level is info.
# Available log levels are: critical, error, warning, info, debug
logging.level: debug
logging.to_files: true
logging.files:
path: /var/log/mybeat
name: mybeat.log
keepfiles: 7
My logstash input and output configs on remote host:
input {
beats {
host => "remote.logstash.host.ip" #the IP Imentioned in filbeat config
port => 5044
type => "beats-syslog"
ssl => "false"
}
}
...
output {
stdout { codec => rubydebug }
}
My logstash is started and it's running :
/opt/logstash/bin/logstash -f /etc/logstash/conf.d/10-syslog.conf
Sending Logstash logs to /opt/logstash/logs which is now configured via log4j2.properties.
[2016-11-14T22:41:29,407][INFO ][logstash.inputs.beats ] Beats inputs: Starting input listener {:address=>"remote.logstash.host.ip:5044"}
[2016-11-14T22:41:29,795][INFO ][org.logstash.beats.Server] Starting server on port: 5044
[2016-11-14T22:41:30,025][INFO ][logstash.pipeline ] Starting pipeline {"id"=>"main", "pipeline.workers"=>2, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>5, "pipeline.max_inflight"=>250}
[2016-11-14T22:41:30,077][INFO ][logstash.pipeline ] Pipeline main started
[2016-11-14T22:41:30,226][INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port=>9600}
and there is nothing after its start.
Whereas filebeat run with
./filebeat -c filebeat.yml -e -d '*'
command is still periodically spaming with the error:
single.go:140: ERR Connecting error publishing events (retrying): dial tcp {remote.logstash.host.ip}:5044: getsockopt: no route to host
On remote host I see that the port and IP where logstash is runnig on are available:
netstat -ltupn | grep 5044
tcp6 0 0 remote.logstash.host.ip:5044 :::* LISTEN 9638/java
I try to connect to logstash host from source host and find no issues:
nc -v remote.logstash.host.ip 5044
Ncat: Version 6.40 ( http://nmap.org/ncat )
Ncat: Connected to remote.logstash.host.ip:5044.
The firewall config does not show issues as iptables are empty and do not have any resistrictions on both hosts.
PIease advise on this issue. I would really aprpeciate your help!