# ERR Connecting error publishing events (retrying): dial tcp x.x.x.x:5044: getsockopt: connection refused

**URL:** <https://discuss.elastic.co/t/err-connecting-error-publishing-events-retrying-dial-tcp-x-x-x-x-getsockopt-connection-refused/147645>\
**Category:** Logstash\
**Created:** [September 7, 2018, 1:37am UTC](https://discuss.elastic.co/t/err-connecting-error-publishing-events-retrying-dial-tcp-x-x-x-x-getsockopt-connection-refused/147645 "2018-09-07T01:37:30Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![BronQ](https://avatars.discourse-cdn.com/v4/letter/b/ec9cab/32.png) [@BronQ](https://discuss.elastic.co/u/BronQ)\
**Post date:** [September 7, 2018, 1:37am UTC](https://discuss.elastic.co/t/err-connecting-error-publishing-events-retrying-dial-tcp-x-x-x-x-getsockopt-connection-refused/147645/1 "2018-09-07T01:37:30Z")

</div>

Hi All,  
Please help, Filebeat failed to send logs to logstash with the error below:

ERR Connecting error publishing events (retrying): dial tcp x.x.x.x:5044: getsockopt: connection refused

Telnet from the client server refused on port 5044

filebeat.yml:

filebeat:  
prospectors:  
-  
paths:  
- /var/log/secure  
- /var/log/messages  
- /var/log/auth.log  
input\_type: log  
document\_type: syslog  
registry\_file: /var/lib/filebeat/registry  
output:  
logstash:  
hosts: ["192.168.2.40:5044"]  
bulk\_max\_size: 100

```
ssl:
  certificate_authorities: ["/etc/pki/tls/certs/logstash-forwarder.crt"]

```

logstash/conf.d/02-beat-input.conf

input {  
beats {  
client\_inactivity\_timeout =\> 86400  
port =\> 5044  
ssl =\> true  
ssl\_certificate =\> "/etc/pki/tls/certs/logstash-forwarder.crt"  
ssl\_key =\> "/etc/pki/tls/private/logstash-forwarder.key"  
}  
}

I removed the ssl on both but still failed:

Thanks for helping  
Bronq

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 7, 2018, 6:04am UTC](https://discuss.elastic.co/t/err-connecting-error-publishing-events-retrying-dial-tcp-x-x-x-x-getsockopt-connection-refused/147645/2 "2018-09-07T06:04:24Z")

</div>

Have you verified that Logstash is starting up okay and actually listening on port 5044 (check with `netstat`)? What's the firewall situation?

---

<div class="post-metadata">

**Author:** ![BronQ](https://avatars.discourse-cdn.com/v4/letter/b/ec9cab/32.png) [@BronQ](https://discuss.elastic.co/u/BronQ)\
**Post date:** [September 7, 2018, 6:24am UTC](https://discuss.elastic.co/t/err-connecting-error-publishing-events-retrying-dial-tcp-x-x-x-x-getsockopt-connection-refused/147645/3 "2018-09-07T06:24:45Z")

</div>

Hi Magnus,

Logstash and Filebeat starts and remains at starting...

Status shows running

Ports are added using firewalld

netstat shows all ports (9200, 9300, 5601) are opened and listening EXCEPT 5044

telnet 192.168.2.40 5044 is refused from the elk server and from the client

I have installed java 1.8.0 65 and 1.8.0.181, none helps to open the 5044 port.

cat /var/filebeat/filebeat  
shows connection refused continuously.

Please let me know if more information is needed.  
Thanks

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 7, 2018, 6:37am UTC](https://discuss.elastic.co/t/err-connecting-error-publishing-events-retrying-dial-tcp-x-x-x-x-getsockopt-connection-refused/147645/4 "2018-09-07T06:37:38Z")

</div>

If nothing's listening on port 5044 then it's an indication that Logstash isn't starting up okay, or that it's running with another configuration than you think it is.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 5, 2018, 6:37am UTC](https://discuss.elastic.co/t/err-connecting-error-publishing-events-retrying-dial-tcp-x-x-x-x-getsockopt-connection-refused/147645/5 "2018-10-05T06:37:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.