BronQ
September 7, 2018, 1:37am
1
Hi All,
Please help, Filebeat failed to send logs to logstash with the error below:
ERR Connecting error publishing events (retrying): dial tcp x.x.x.x:5044: getsockopt: connection refused
Telnet from the client server refused on port 5044
filebeat.yml:
filebeat:
prospectors:
-
paths:
- /var/log/secure
- /var/log/messages
- /var/log/auth.log
input_type: log
document_type: syslog
registry_file: /var/lib/filebeat/registry
output:
logstash:
hosts: ["192.168.2.40:5044"]
bulk_max_size: 100
ssl:
certificate_authorities: ["/etc/pki/tls/certs/logstash-forwarder.crt"]
logstash/conf.d/02-beat-input.conf
input {
beats {
client_inactivity_timeout => 86400
port => 5044
ssl => true
ssl_certificate => "/etc/pki/tls/certs/logstash-forwarder.crt"
ssl_key => "/etc/pki/tls/private/logstash-forwarder.key"
}
}
I removed the ssl on both but still failed:
Thanks for helping
Bronq
Have you verified that Logstash is starting up okay and actually listening on port 5044 (check with netstat
)? What's the firewall situation?
BronQ
September 7, 2018, 6:24am
3
Hi Magnus,
Logstash and Filebeat starts and remains at starting...
Status shows running
Ports are added using firewalld
netstat shows all ports (9200, 9300, 5601) are opened and listening EXCEPT 5044
telnet 192.168.2.40 5044 is refused from the elk server and from the client
I have installed java 1.8.0 65 and 1.8.0.181, none helps to open the 5044 port.
cat /var/filebeat/filebeat
shows connection refused continuously.
Please let me know if more information is needed.
Thanks
If nothing's listening on port 5044 then it's an indication that Logstash isn't starting up okay, or that it's running with another configuration than you think it is.
system
(system)
Closed
October 5, 2018, 6:37am
5
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.