ERR Connecting error publishing events (retrying): dial tcp x.x.x.x:5044: getsockopt: connection refused

[BronQ]

Hi All,
Please help, Filebeat failed to send logs to logstash with the error below:

ERR Connecting error publishing events (retrying): dial tcp x.x.x.x:5044: getsockopt: connection refused

Telnet from the client server refused on port 5044

filebeat.yml:

filebeat:
prospectors:
-
paths:
- /var/log/secure
- /var/log/messages
- /var/log/auth.log
input_type: log
document_type: syslog
registry_file: /var/lib/filebeat/registry
output:
logstash:
hosts: ["192.168.2.40:5044"]
bulk_max_size: 100

ssl:
  certificate_authorities: ["/etc/pki/tls/certs/logstash-forwarder.crt"]

logstash/conf.d/02-beat-input.conf

input {
beats {
client_inactivity_timeout => 86400
port => 5044
ssl => true
ssl_certificate => "/etc/pki/tls/certs/logstash-forwarder.crt"
ssl_key => "/etc/pki/tls/private/logstash-forwarder.key"
}
}

I removed the ssl on both but still failed:

Thanks for helping
Bronq

[magnusbaeck (Magnus Bäck)]

Have you verified that Logstash is starting up okay and actually listening on port 5044 (check with netstat)? What's the firewall situation?

[BronQ]

Hi Magnus,

Logstash and Filebeat starts and remains at starting...

Status shows running

Ports are added using firewalld

netstat shows all ports (9200, 9300, 5601) are opened and listening EXCEPT 5044

telnet 192.168.2.40 5044 is refused from the elk server and from the client

I have installed java 1.8.0 65 and 1.8.0.181, none helps to open the 5044 port.

cat /var/filebeat/filebeat
shows connection refused continuously.

Please let me know if more information is needed.
Thanks

[magnusbaeck (Magnus Bäck)]

If nothing's listening on port 5044 then it's an indication that Logstash isn't starting up okay, or that it's running with another configuration than you think it is.