This is what im getting when i tried to connect filebeat to logstash. Can someone tell me what kind of issue is this. In my point of view im thinking its about port issue. I dont know i may be wrong. Some one take a look at this and find it solved. Thanking You.
Hi @DharaniKumar,
Could you please share your filebeat output settings? It seems there is something wrong in the connection between filebeat and logstash
Hello @exekias
This is filebeat.yml for logstash config
#output.logstash:
The Logstash hosts
hosts: ["XXX.XXX.XX.XX:5044"]
Optional SSL. By default is off.
List of root certificates for HTTPS server verifications
#ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]
Certificate for SSL client authentication
#ssl.certificate: "/etc/pki/client/cert.pem"
Client Certificate Key
#ssl.key: "/etc/pki/client/cert.key"
It looks like you are getting a timeout connecting to logstash, some things to check:
- beats input is enabled in logstash https://www.elastic.co/guide/en/logstash/current/plugins-inputs-beats.html
- filebeat can reach logstash host (check the port is open and reachable, no firewall in place)
This is filebeat.full.yml file
#output.logstash:
Boolean flag to enable or disable the output module.
enabled: true
The Logstash hosts
hosts: ["XXX.XXX.XX.XX:5044"]
Number of workers per Logstash host.
worker: 1
Set gzip compression level.
#compression_level: 3
Optional load balance the events between the Logstash hosts
#loadbalance: true
Number of batches to be send asynchronously to logstash while processing
new batches.
pipelining: 1
Optional index name. The default index name is set to name of the beat
in all lowercase.
index: 'filebeat'
SOCKS5 proxy server URL
#proxy_url: socks5://user:password@socks5-server:2233
Resolve names locally when using a proxy server. Defaults to false.
#proxy_use_local_resolver: false
Enable SSL support. SSL is automatically enabled, if any SSL setting is set.
ssl.enabled: false
Configure SSL verification mode. If none is configured, all server hosts
and certificates will be accepted. In this mode, SSL based connections are
susceptible to man-in-the-middle attacks. Use only for testing. Default is
full.
#ssl.verification_mode: full
List of supported/valid TLS versions. By default all TLS versions 1.0 up to
1.2 are enabled.
#ssl.supported_protocols: [TLSv1.0, TLSv1.1, TLSv1.2]
Optional SSL configuration options. SSL is off by default.
List of root certificates for HTTPS server verifications
#ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]
Certificate for SSL client authentication
#ssl.certificate: "/etc/pki/client/cert.pem"
Client Certificate Key
#ssl.key: "/etc/pki/client/cert.key"
Optional passphrase for decrypting the Certificate Key.
#ssl.key_passphrase: ''
Configure cipher suites to be used for SSL connections
#ssl.cipher_suites: []
Configure curve types for ECDHE based cipher suites
#ssl.curve_types: []
This is what im getting after installing input beats plugin. Then i run filebeat and filebeat is throwing this error.
2017-06-23T17:14:53+05:30 ERR Connecting error publishing events (retrying): Get http://XXX.XXX.XX.XX:5044: dial tcp XXX.XXX.XX.XX:5044: getsockopt: connection refused
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.