# Error after upgrading to ELK 5

**URL:** <https://discuss.elastic.co/t/error-after-upgrading-to-elk-5/85091>\
**Category:** Logstash\
**Created:** [May 9, 2017, 12:40pm UTC](https://discuss.elastic.co/t/error-after-upgrading-to-elk-5/85091 "2017-05-09T12:40:39Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![RustuGurkan](https://avatars.discourse-cdn.com/v4/letter/r/a183cd/32.png) [@RustuGurkan](https://discuss.elastic.co/u/RustuGurkan)\
**Post date:** [May 9, 2017, 12:40pm UTC](https://discuss.elastic.co/t/error-after-upgrading-to-elk-5/85091/1 "2017-05-09T12:40:39Z")

</div>

Hi,

I've upgraded to ELK 5 so now everything is in the 5 version but after the upgrade ELK stopped recieving logs  
when I put this command  
`curl -XGET 'http://localhost:9200/filebeat-*/_search?pretty'`

I'm getting a hit but on nothing shows up on kibana  
I checked my logs and it says  
`ERR Connecting error publishing events (retrying): dial tcp 192.168.154.100:5044: getsockopt: connection refused`

My config for beats is like this:

```
input {
  beats {
    port => 5044
    ssl => true
    ssl_certificate => "/etc/pki/tls/certs/logstash-forwarder.crt"
    ssl_key => "/etc/pki/tls/private/logstash-forwarder.key"
  }
}

#pfSense
#tcp syslog stream via 5140
input {
  tcp {
    type => "syslog"
    port => 5140
  }
}
#udp syslogs tream via 5140
input {
  udp {
    type => "syslog"
    port => 5140
  }
}

```

and my filebeat.yml looks like this

```
filebeat:
  prospectors:
    -
      paths:
      - /var/log/secure
      - /var/log/messages
      document_type: syslog
    -
      paths:
      - /var/log/yum.log
      document_type: yumlog

    - 
      paths:
      - /var/log/nginx/access.log
      document_type: nginx-access

    -
      paths:
      - /var/log/httpd/access_log
      document_type: apache-access

    -
      paths:
      - /var/log/cron
      document_type: cronlog

    -
      paths:
      - /var/log/audit/audit.log
      document_type: auditlog

    -
      paths:
      - /var/log/maillog
      document_type: maillog

  registry_file: /var/lib/filebeat/registry

```

It was working fine before but now it doesn't and I just don't get why?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [May 9, 2017, 1:16pm UTC](https://discuss.elastic.co/t/error-after-upgrading-to-elk-5/85091/2 "2017-05-09T13:16:02Z")

</div>

Does Logstash start up properly? Have you looked in the Logstash log? Does it actually listen on port 5044?

---

<div class="post-metadata">

**Author:** ![RustuGurkan](https://avatars.discourse-cdn.com/v4/letter/r/a183cd/32.png) [@RustuGurkan](https://discuss.elastic.co/u/RustuGurkan)\
**Post date:** [May 9, 2017, 1:52pm UTC](https://discuss.elastic.co/t/error-after-upgrading-to-elk-5/85091/3 "2017-05-09T13:52:30Z")

</div>

@magnusbaeck Thank for the reply,  
Yes it does I checked with systemctl status logstash and it says active.  
I also looked at the log files of logstash but I don't know how I can see wich port it is listening to however it worked before I updated it.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 6, 2017, 2:01pm UTC](https://discuss.elastic.co/t/error-after-upgrading-to-elk-5/85091/4 "2017-06-06T14:01:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.