I am trying to parse Bro IDS logs using ELK stack and getting this error:
Connection refused {:class=>"Manticore::SocketException", :level=>:error}
Connection refused {:class=>"Manticore::SocketException", :level=>:error}
Connection refused {:class=>"Manticore::SocketException", :level=>:error}
Connection refused {:class=>"Manticore::SocketException", :level=>:error}
Google search tells me that this is due to the fact that logstash is trying to find elastic instance but not finding it.
This is strange as this error is generated when I changed my output configuration recently.
Output section of my logstash old and new configuration are as follows:
Logstash: logstash 2.2.0
elastic - elastic 2.2.0
Old
output {
#stdout { codec => rubydebug }
if [type] == 'BRO_dnslog' {
elasticsearch {
hosts => ["10.4.0.4", "10.4.0.8","10.4.0.9"]
flush_size => 2000
workers =>2
index => "bro-dns-%{+YYYY.MM.dd}"
}
}
}
New:
output {
#stdout { codec => rubydebug }
elasticsearch {
hosts => ["10.4.0.4", "10.4.0.8","10.4.0.9"]
flush_size => 2000
workers =>2
}
if [type] == 'BRO_dnslog' {
elasticsearch {
index => "bro-dns-%{+YYYY.MM.dd}"
}
}
}
The idea behind new configuration is to take out all the common settings of elastic in a separate block and only set index name as per Bro log [type]. The "--configtest" option of logstash also does not raise any errors for this case.
Any help/comment will be appreciated.