# ERR Connecting error publishing events (retrying)

**URL:** <https://discuss.elastic.co/t/err-connecting-error-publishing-events-retrying/82625>\
**Category:** Beats\
**Created:** [April 17, 2017, 8:05pm UTC](https://discuss.elastic.co/t/err-connecting-error-publishing-events-retrying/82625 "2017-04-17T20:05:31Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Steve\_1](https://avatars.discourse-cdn.com/v4/letter/s/ebca7d/32.png) [@Steve\_1](https://discuss.elastic.co/u/Steve_1)\
**Post date:** [April 17, 2017, 8:05pm UTC](https://discuss.elastic.co/t/err-connecting-error-publishing-events-retrying/82625/1 "2017-04-17T20:05:31Z")

</div>

Hi. I have a problem when Beats connecting to Logstash:

```
2017-04-17T14:53:22-05:00 INFO Harvester started for file: /var/elk/logFile.log
2017-04-17T14:53:22-05:00 ERR Connecting error publishing events (retrying): dial tcp **.***. **.** :5044: getsockopt: connection refused
2017-04-17T14:53:23-05:00 ERR Connecting error publishing events (retrying): dial tcp **.***. **.** :5044: getsockopt: connection refused

```

I checked Logstash and it worked fine when it was reading files in local directory. I also ran telnet command:

```
# telnet localhost 5044
Trying ::1...
Connected to localhost.
Escape character is '^]'.
Connection closed by foreign host.

```

And it's unclear for me if Logstash works as expected or not. Or it's Beats problem. Any ideas?  
I tried to forward logs from Beats to Elasticsearch and it worked good.  
Providing filebeat.yml file

```
filebeat.prospectors:

- input_type: log

  paths:
    - /var/elk/logFile.log

registry_file: /var/lib/filebeat/registry

output.logstash:

  hosts: ["myhost:5044"]

  ssl:
    certificate_authorities: ["/etc/pki/tls/certs/logstash-forwarder.crt"]
```

---

<div class="post-metadata">

**Author:** ![giuseppe](https://avatars.discourse-cdn.com/v4/letter/g/48db29/32.png) [@giuseppe](https://discuss.elastic.co/u/giuseppe)\
**Post date:** [April 17, 2017, 8:31pm UTC](https://discuss.elastic.co/t/err-connecting-error-publishing-events-retrying/82625/2 "2017-04-17T20:31:16Z")

</div>

Not sure it would make a difference, but any reason not to specify the config as:

```auto
< ssl:
< certificate_authorities: ["/etc/pki/tls/certs/logstash-forwarder.crt"]
---
> ssl.certificate_authorities: ["/etc/pki/tls/certs/logstash-forwarder.crt"]

```

Is Logstash using a certificate that is valid vs that CA?

---

<div class="post-metadata">

**Author:** ![Steve\_1](https://avatars.discourse-cdn.com/v4/letter/s/ebca7d/32.png) [@Steve\_1](https://discuss.elastic.co/u/Steve_1)\
**Post date:** [April 17, 2017, 9:38pm UTC](https://discuss.elastic.co/t/err-connecting-error-publishing-events-retrying/82625/3 "2017-04-17T21:38:34Z")

</div>

Actually there is no difference with that formatting.

My logstash.config input is

```
input {
  beats {
    port => 5044
    ssl => true
    ssl_certificate => "/usr/share/logstash/certs/logstash-forwarder.crt"
    ssl_key => "/usr/share/logstash/certs/logstash-forwarder.key"
  }
}

```

I just copied `/usr/share/logstash/certs/logstash-forwarder.crt` to another server with Filebeat to directory `/etc/pki/tls/certs/`

The issue is in certificates. Is this correct command to generate them?  
`openssl req -x509 -nodes -newkey rsa:2048 -keyout logstash-forwarder.key -out logstash-forwarder.crt`

And this is from lgos:

`ERR Connecting error publishing events (retrying): x509: certificate is valid for "ABC", not "myhost"`

---

<div class="post-metadata">

**Author:** ![giuseppe](https://avatars.discourse-cdn.com/v4/letter/g/48db29/32.png) [@giuseppe](https://discuss.elastic.co/u/giuseppe)\
**Post date:** [April 18, 2017, 11:06pm UTC](https://discuss.elastic.co/t/err-connecting-error-publishing-events-retrying/82625/4 "2017-04-18T23:06:42Z")

</div>

Sounds like the certificate being used on the Logstash server is not valid for the hostname you're running filebeat on. Maybe you want to add an alternative via `-subj`?

---

<div class="post-metadata">

**Author:** ![Steve\_1](https://avatars.discourse-cdn.com/v4/letter/s/ebca7d/32.png) [@Steve\_1](https://discuss.elastic.co/u/Steve_1)\
**Post date:** [April 19, 2017, 12:13am UTC](https://discuss.elastic.co/t/err-connecting-error-publishing-events-retrying/82625/5 "2017-04-19T00:13:41Z")

</div>

Recreated certificate - works good now.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 8, 2017, 8:18pm UTC](https://discuss.elastic.co/t/err-connecting-error-publishing-events-retrying/82625/6 "2017-05-08T20:18:21Z")

</div>

This topic was automatically closed after 21 days. New replies are no longer allowed.