ERR Connecting error publishing events


I am brand new to this and I have installed the ELK server based on this -

It appears to working fine.

I installed the winlogbeat on a Windows 2008 r2 server and I am attempting to send the event logs to the elk server - here is my config.

  - name: Application
    ignore_older: 72h
  - name: Security
  - name: System

#----------------------------- Logstash output --------------------------------
  # The Logstash hosts
    hosts: [""]

  # Optional SSL. By default is off.
  # List of root certificates for HTTPS server verifications
  #ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]

  # Certificate for SSL client authentication
  #ssl.certificate: "/etc/pki/client/cert.pem"

  # Client Certificate Key
  #ssl.key: "/etc/pki/client/cert.key"

#================================ Logging =====================================

# Sets log level. The default log level is info.
# Available log levels are: critical, error, warning, info, debug
#logging.level: debug

The error I am getting is -
2017-03-20T12:21:44-04:00 ERR Connecting error publishing events (retrying): Get EOF

I am not using SSL.

The beat file config is.

input {
  beats {
    port => 5044

Any suggestions?



The beat is trying to use the elasticsearch output and not the logstash output.

Make sure that you have commented out or removed the elasticsearch configuration block. Then you need to uncomment the logstash output. You still have #output.logstash: in your config file which comments out the logstash config.

1 Like

Awesome - working now - I missed that thanks.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.