Hi there!
I'm trying to send logs with filebeat to remote logstash host but receive the error on each attempt of filebeat to push to remote logstash host. Both hosts are running on linux. The logstash is up on remote host. But nevertheless:
single.go:140: ERR Connecting error publishing events (retrying): dial tcp {remote.logstash.host.ip}:5044: getsockopt: no route to host
I have a source host where filebeat is running . Here's its config:
#=========================== Filebeat prospectors ============================= filebeat.prospectors: - input_type: log # Paths that should be crawled and fetched. Glob based paths. paths: - /var/log/messages#================================ General ===================================== # The name of the shipper that publishes the network data. It can be used to group # all the transactions sent by a single shipper in the web interface. #name: # The tags of the shipper are included in their own field with each # transaction published. tags: ["filebeat", "testing"] #================================ Outputs ===================================== # Configure what outputs to use when sending the data collected by the beat. # Multiple outputs may be used. #-------------------------- Elasticsearch output ------------------------------ output.elasticsearch: enabled: false # Array of hosts to connect to. hosts: ["remote.elastic.host.ip:9200"] # Optional protocol and basic auth credentials. #protocol: "https" #username: "elastic" #password: "changeme" #----------------------------- Logstash output -------------------------------- output.logstash: enabled: true # The Logstash hosts hosts: ["remote.logstash.host.ip:5044"] console: pretty: true #================================ Logging ===================================== # Sets log level. The default log level is info. # Available log levels are: critical, error, warning, info, debug logging.level: debug logging.to_files: true logging.files: path: /var/log/mybeat name: mybeat.log keepfiles: 7My logstash input and output configs on remote host:
input { beats { host => "remote.logstash.host.ip" #the IP Imentioned in filbeat config port => 5044 type => "beats-syslog" ssl => "false" } } ... output { stdout { codec => rubydebug } }My logstash is started and it's running :
/opt/logstash/bin/logstash -f /etc/logstash/conf.d/10-syslog.conf Sending Logstash logs to /opt/logstash/logs which is now configured via log4j2.properties. [2016-11-14T22:41:29,407][INFO ][logstash.inputs.beats ] Beats inputs: Starting input listener {:address=>"remote.logstash.host.ip:5044"} [2016-11-14T22:41:29,795][INFO ][org.logstash.beats.Server] Starting server on port: 5044 [2016-11-14T22:41:30,025][INFO ][logstash.pipeline ] Starting pipeline {"id"=>"main", "pipeline.workers"=>2, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>5, "pipeline.max_inflight"=>250} [2016-11-14T22:41:30,077][INFO ][logstash.pipeline ] Pipeline main started [2016-11-14T22:41:30,226][INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port=>9600}and there is nothing after its start.
Whereas filebeat run with./filebeat -c filebeat.yml -e -d '*'command is still periodically spaming with the error:single.go:140: ERR Connecting error publishing events (retrying): dial tcp {remote.logstash.host.ip}:5044: getsockopt: no route to hostOn remote host I see that the port and IP where logstash is runnig on are available:
netstat -ltupn | grep 5044 tcp6 0 0 remote.logstash.host.ip:5044 :::* LISTEN 9638/javaI try to connect to logstash host from source host and find no issues:
nc -v remote.logstash.host.ip 5044 Ncat: Version 6.40 ( http://nmap.org/ncat ) Ncat: Connected to remote.logstash.host.ip:5044.The firewall config does not show issues as iptables are empty and do not have any resistrictions on both hosts.
PIease advise on this issue. I would really aprpeciate your help!