ERROR pipeline/output.go:100 Failed to connect to backoff(async(tcp://0.0.0.0:5044)): dial tcp 0.0.0.0:5044: connect: connection refused

Elastic Stack Beats
#1

Here below filebeat.yml output configuration

   output.logstash:
  enabled: true
  hosts: ["0.0.0.0:5044"]
  timeout: 86400``

logstash.conf input configuration

input {
       	beats {
            port => 5044
            host => "0.0.0.0"
            ssl  => false
    }
}

I am using filebeat-oss 6.8.9 and logtash-oss 6.8.9

#2

Welcome to our community! :smiley:

What do your Logstash and Filebeat logs show?

#3

Filebeat logs showing

|ERROR|pipeline/output.go:100|Failed to connect to backoff(async(tcp://logstash:5044)): lookup logstash on 127.0.0.11:53: no such host|
|---|---|---|
|ERROR|pipeline/output.go:100|Failed to connect to backoff(async(tcp://logstash:5044)): lookup logstash on 127.0.0.11:53: no such host|
|ERROR|pipeline/output.go:100|Failed to connect to backoff(async(tcp://logstash:5044)): lookup logstash on 127.0.0.11:53: no such host|

Logstash logs showing

[2021-01-04T21:13:31,431][INFO ][logstash.setting.writabledirectory] Creating directory {:setting=>"path.queue", :path=>"/usr/share/logstash/data/queue"}
[2021-01-04T21:13:31,463][INFO ][logstash.setting.writabledirectory] Creating directory {:setting=>"path.dead_letter_queue", :path=>"/usr/share/logstash/data/dead_letter_queue"}
[2021-01-04T21:13:32,283][INFO ][logstash.runner          ] Starting Logstash {"logstash.version"=>"6.8.9"}
[2021-01-04T21:13:32,354][INFO ][logstash.agent           ] No persistent UUID file found. Generating new UUID {:uuid=>"1f05e506-3393-4869-811d-5e1f9f00f517", :path=>"/usr/share/logstash/data/uuid"}
[2021-01-04T21:14:16,604][INFO ][logstash.pipeline        ] Starting pipeline {:pipeline_id=>"main", "pipeline.workers"=>2, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>50}
[2021-01-04T21:15:04,181][INFO ][logstash.inputs.beats    ] Beats inputs: Starting input listener {:address=>"logstash:5044"}
[2021-01-04T21:15:04,221][INFO ][logstash.pipeline        ] Pipeline started successfully {:pipeline_id=>"main", :thread=>"#<Thread:0x56387c18 run>"}
[2021-01-04T21:15:04,419][INFO ][logstash.agent           ] Pipelines running {:count=>1, :running_pipelines=>[:main], :non_running_pipelines=>[]}
[2021-01-04T21:15:04,510][INFO ][org.logstash.beats.Server] Starting server on port: 5044
[2021-01-04T21:15:05,196][INFO ][logstash.agent           ] Successfully started Logstash API endpoint {:port=>9600}
#4

Thanks.

That is not valid as an output. As you can see in the log the OS thinks you want to connect to localhost, and not the actual Logstash host. You will need to change the IP there to an IP that belongs to the Logstash host.

#5

Sorry
Later I have changed 0.0.0.0 to logstash that why now it is logstash

Here is new filebeat logs with 0.0.0.0 host

ERROR	pipeline/output.go:100	Failed to connect to backoff(async(tcp://0.0.0.0:5044)): dial tcp 0.0.0.0:5044: connect: connection refused
ERROR	pipeline/output.go:100	Failed to connect to backoff(async(tcp://0.0.0.0:5044)): dial tcp 0.0.0.0:5044: connect: connection refused

Logtash logs with 0.0.0.0 host

Sending Logstash logs to /usr/share/logstash/logs which is now configured via log4j2.properties
[2021-01-05T07:24:55,810][INFO ][logstash.setting.writabledirectory] Creating directory {:setting=>"path.queue", :path=>"/usr/share/logstash/data/queue"}
[2021-01-05T07:24:55,844][INFO ][logstash.setting.writabledirectory] Creating directory {:setting=>"path.dead_letter_queue", :path=>"/usr/share/logstash/data/dead_letter_queue"}
[2021-01-05T07:24:56,707][INFO ][logstash.runner          ] Starting Logstash {"logstash.version"=>"6.8.9"}
[2021-01-05T07:24:56,754][INFO ][logstash.agent           ] No persistent UUID file found. Generating new UUID {:uuid=>"fa698f3d-11a6-4c08-a920-860e4873d1e5", :path=>"/usr/share/logstash/data/uuid"}
[2021-01-05T07:25:39,563][INFO ][logstash.pipeline        ] Starting pipeline {:pipeline_id=>"main", "pipeline.workers"=>2, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>50}
#6

Does logstash resolve to an actual IP though?

#7

I have used 0.0.0.0 host.
Logtash & filebeat is same server and different container