# Error in Filebeat **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [March 18, 2017, 8:10pm UTC](https://discuss.elastic.co/t/error-in-filebeat/79146 "2017-03-18T20:10:31Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![AHK](https://avatars.discourse-cdn.com/v4/letter/a/e56c9b/32.png) [@AHK](https://discuss.elastic.co/u/AHK)\ **Post date:** [March 18, 2017, 8:10pm UTC](https://discuss.elastic.co/t/error-in-filebeat/79146/1 "2017-03-18T20:10:31Z")
Hello, I am trying to learn how to install & use ELK Stack on Centos7 I have installed JAVA and every thing according to this link > **[How To Install Elasticsearch, Logstash, and Kibana (ELK Stack) on CentOS 7 |...](https://www.digitalocean.com/community/tutorials/how-to-install-elasticsearch-logstash-and-kibana-elk-stack-on-centos-7)** > > In this tutorial, we will go over the installation of the Elasticsearch ELK Stack on CentOS 7—that is, Elasticsearch 2.1.x, Logstash 2.1.x, and Kibana 4.3.x. We will also show you how to configure it to gather and visualize the syslogs of your... now on my Server every thing is running fine, and when i test systemctl status logstash i got this response logstash.service - LSB: Starts Logstash as a daemon. Loaded: loaded (/etc/rc.d/init.d/logstash; bad; vendor preset: disabled) Active: active (exited) since Sat 2017-03-18 15:55:18 EDT; 7min ago Docs: man:systemd-sysv-generator(8) Mar 18 15:55:18 [srv.xxx.biz](http://srv.xxx.biz) systemd[1]: Starting LSB: Starts Logstash as a daemon.... Mar 18 15:55:18 [srv.xxx.biz](http://srv.xxx.biz) logstash[5774]: logstash started. Mar 18 15:55:18 [srv.xxx.biz](http://srv.xxx.biz) systemd[1]: Started LSB: Starts Logstash as a daemon.. ON client machine i install Filebeat and start service but its not sending LOGS, so when i use this command [root@srv1 ~]# systemctl status filebeat ● filebeat.service - filebeat Loaded: loaded (/usr/lib/systemd/system/filebeat.service; enabled; vendor preset: disabled) Active: active (running) since Sat 2017-03-18 15:56:03 EDT; 8min ago Docs: [https://www.elastic.co/guide/en/beats/filebeat/current/index.html](https://www.elastic.co/guide/en/beats/filebeat/current/index.html) Main PID: 1586 (filebeat) CGroup: /system.slice/filebeat.service └─1586 /usr/bin/filebeat -c /etc/filebeat/filebeat.yml Mar 18 15:56:03 [srv1.xxx.biz](http://srv1.xxx.biz) systemd[1]: Started filebeat. Mar 18 15:56:03 [srv1.xxx.biz](http://srv1.xxx.biz) systemd[1]: Starting filebeat... Mar 18 15:56:03 [srv1.xxx.biz](http://srv1.xxx.biz) /usr/bin/filebeat[1586]: transport.go:125: SSL client failed to connect with: dial tcp xxx.xxx.242.35:5044: getsockopt: connection refused [root@srv1 ~]# even i use insecure: true option in config file as bellow filebeat: prospectors: - paths: - /var/log/secure - /var/log/messages # - /var/log/\*.log ``` input_type: log document_type: syslog ``` registry\_file: /var/lib/filebeat/registry output: logstash: hosts: ["xxx.xxx.242.35:5044"] bulk\_max\_size: 1024 ``` tls: #certificate_authorities: ["/etc/pki/tls/certs/logstash-forwarder.crt"] insecure: true ``` shipper: logging: files: rotateeverybytes: 10485760 # = 10MB i also follow this link > and test my connection with this command curl -v --cacert logstash-forwarder.crt [https://xxx.xxx.242.35:5044](https://xxx.xxx.242.35:5044) on both Server and Client i got this error Failed connect to xxx.xxx.242.35:5044; Connection refused when i try to use telnet command from client server **telnet xxx.xxx.242.35 5044** I got this error _ **telnet: connect to address xxx.xxx.242.35: Connection refused** _ also when i check in my server sudo netstat -plnt I see this output Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 127.0.0.1:5601 0.0.0.0:\* LISTEN 4521/node tcp 0 0 0.0.0.0:111 0.0.0.0:\* LISTEN 1/systemd tcp 0 0 0.0.0.0:80 0.0.0.0:\* LISTEN 4750/nginx: master tcp 0 0 0.0.0.0:22 0.0.0.0:\* LISTEN 882/sshd tcp6 0 0 :::111 :::\* LISTEN 795/rpcbind tcp6 0 0 ::1:9200 :::\* LISTEN 4369/java tcp6 0 0 127.0.0.1:9200 :::\* LISTEN 4369/java tcp6 0 0 ::1:9300 :::\* LISTEN 4369/java tcp6 0 0 127.0.0.1:9300 :::\* LISTEN 4369/java tcp6 0 0 :::22 :::\* LISTEN 882/sshd how can i fix this issue... I try my best from 2 days but no Luck... Thanks ---
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [March 20, 2017, 11:33am UTC](https://discuss.elastic.co/t/error-in-filebeat/79146/2 "2017-03-20T11:33:20Z")
There definitively seems to be an issue between with the connection between filebeat and LS. Which versions of Filebeat, Logstash, Elasticsearch are you using? I strongly recommend you to follow the getting started here as it is up-to-date with all the recent changes: [https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-getting-started.html](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-getting-started.html) ---
**Author:** ![Michael\_TRAN](https://avatars.discourse-cdn.com/v4/letter/m/2acd7d/32.png) [@Michael\_TRAN](https://discuss.elastic.co/u/Michael_TRAN)\ **Post date:** [March 20, 2017, 1:17pm UTC](https://discuss.elastic.co/t/error-in-filebeat/79146/3 "2017-03-20T13:17:19Z")
Hello, I have this error with my filebeat service status too. But when I edit my logstash configuration file, filebeat is working again. Could you check that and tell me if you have the same issue ? Thanks. Michael ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [March 27, 2017, 5:25pm UTC](https://discuss.elastic.co/t/error-in-filebeat/79146/4 "2017-03-27T17:25:07Z")
Please properly format your posts (It's that unreadable, I just skimmed it). Use the ``-button for logs and configurations. which Logstash and Filebeat version are you using? Do they match the blog-post versions? In 5.0 the SSL/TLS settings must use the `ssl` namespace, but you're using `tls`. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 24, 2017, 5:25pm UTC](https://discuss.elastic.co/t/error-in-filebeat/79146/5 "2017-04-24T17:25:08Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.