Error filebeast from Windows machine to vmware Ubuntu machine

Elastic Stack Beats
1

Good Morning,
I am trying to send logs from filebeats (in a windows machine) to logstash (in a vmware ubuntu machine)
but I got this error:
Connecting error publishing events (retrying): dial tcp 192.168.220.130:5044: connectex: No connection could be made because the target machine actively refused it.

The configuration is :
filebeat.yml in a windows machine:
output: logstash: hosts: ["192.168.220.130:5044"] index : filebeat console: pretty: true worker: 1
logstash.config in a vmware ubuntu machine :
input { lumberjack { port => 5044 type => beats ssl_certificate => "/etc/ssl/logstash.pub" ssl_key => "/etc/ssl/logstash.key" } }

Any tips ?
I tried the same config internally in a vmware ubuntu machine and it is working fine.

2

Use the beats input plugin to receive data from Filebeat and other beats.

3

What do you mean ?
this is my full config of filebeat.yml in windows

`filebeat:
prospectors:

  paths:
     - c:\log\*.log
  input_type: log
  document_type: oldLogs

registry_file: "c:\filebeat\registry"
output:
logstash:
hosts: ["192.168.220.130:5044"]
index : filebeat
console:
pretty: true
worker: 1`

4

Yes, but in the Logstash configuration you should use the beats input plugin, not lumberjack. You also need to make sure the that Filebeat machine can connect to port 5044 on the Logstash machine when Logstash is running, which isn't the case right now according to your error message. Perhaps a firewall is blocking the access?

5

I stopped and disabled the ubuntu firewall.

I tried with both configuration (above and below),
input { beats { type => beats port => 5044 } }

I am using Bridge Network, I can ping the vmware ubuntu machine but same problem :
Connecting error publishing events (retrying): dial tcp 192.168.220.130:5044: connectex: No connection could be made because the target machine actively refused it.

Any clue?

6

This is either a networking or firewall problem as previously mentioned.
You may want to check with your VM admin.

7

Fixed.
I had 2 different error:

  1. In vmware I must use : Bridge Network
  2. My error in the ELK configuration files.
    Now it is working fine.
8

Same problem here, what was your solution in the config?