UjjwalBera
(Ujjwal Bera)
January 4, 2021, 6:56pm
1
Here below filebeat.yml output configuration
output.logstash:
enabled: true
hosts: ["0.0.0.0:5044"]
timeout: 86400``
logstash.conf input configuration
input {
beats {
port => 5044
host => "0.0.0.0"
ssl => false
}
}
I am using filebeat-oss 6.8.9 and logtash-oss 6.8.9
warkolm
(Mark Walkom)
January 5, 2021, 12:36am
2
Welcome to our community!
What do your Logstash and Filebeat logs show?
UjjwalBera
(Ujjwal Bera)
January 5, 2021, 7:16am
3
warkolm:
Filebeat
Filebeat logs showing
|ERROR|pipeline/output.go:100|Failed to connect to backoff(async(tcp://logstash:5044)): lookup logstash on 127.0.0.11:53: no such host|
|---|---|---|
|ERROR|pipeline/output.go:100|Failed to connect to backoff(async(tcp://logstash:5044)): lookup logstash on 127.0.0.11:53: no such host|
|ERROR|pipeline/output.go:100|Failed to connect to backoff(async(tcp://logstash:5044)): lookup logstash on 127.0.0.11:53: no such host|
Logstash logs showing
[2021-01-04T21:13:31,431][INFO ][logstash.setting.writabledirectory] Creating directory {:setting=>"path.queue", :path=>"/usr/share/logstash/data/queue"}
[2021-01-04T21:13:31,463][INFO ][logstash.setting.writabledirectory] Creating directory {:setting=>"path.dead_letter_queue", :path=>"/usr/share/logstash/data/dead_letter_queue"}
[2021-01-04T21:13:32,283][INFO ][logstash.runner ] Starting Logstash {"logstash.version"=>"6.8.9"}
[2021-01-04T21:13:32,354][INFO ][logstash.agent ] No persistent UUID file found. Generating new UUID {:uuid=>"1f05e506-3393-4869-811d-5e1f9f00f517", :path=>"/usr/share/logstash/data/uuid"}
[2021-01-04T21:14:16,604][INFO ][logstash.pipeline ] Starting pipeline {:pipeline_id=>"main", "pipeline.workers"=>2, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>50}
[2021-01-04T21:15:04,181][INFO ][logstash.inputs.beats ] Beats inputs: Starting input listener {:address=>"logstash:5044"}
[2021-01-04T21:15:04,221][INFO ][logstash.pipeline ] Pipeline started successfully {:pipeline_id=>"main", :thread=>"#<Thread:0x56387c18 run>"}
[2021-01-04T21:15:04,419][INFO ][logstash.agent ] Pipelines running {:count=>1, :running_pipelines=>[:main], :non_running_pipelines=>[]}
[2021-01-04T21:15:04,510][INFO ][org.logstash.beats.Server] Starting server on port: 5044
[2021-01-04T21:15:05,196][INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port=>9600}
warkolm
(Mark Walkom)
January 5, 2021, 7:18am
4
Thanks.
UjjwalBera:
hosts: ["0.0.0.0:5044"]
That is not valid as an output. As you can see in the log the OS thinks you want to connect to localhost, and not the actual Logstash host. You will need to change the IP there to an IP that belongs to the Logstash host.
UjjwalBera
(Ujjwal Bera)
January 5, 2021, 7:21am
5
Sorry
Later I have changed 0.0.0.0 to logstash that why now it is logstash
Here is new filebeat logs with 0.0.0.0 host
ERROR pipeline/output.go:100 Failed to connect to backoff(async(tcp://0.0.0.0:5044)): dial tcp 0.0.0.0:5044: connect: connection refused
ERROR pipeline/output.go:100 Failed to connect to backoff(async(tcp://0.0.0.0:5044)): dial tcp 0.0.0.0:5044: connect: connection refused
Logtash logs with 0.0.0.0 host
Sending Logstash logs to /usr/share/logstash/logs which is now configured via log4j2.properties
[2021-01-05T07:24:55,810][INFO ][logstash.setting.writabledirectory] Creating directory {:setting=>"path.queue", :path=>"/usr/share/logstash/data/queue"}
[2021-01-05T07:24:55,844][INFO ][logstash.setting.writabledirectory] Creating directory {:setting=>"path.dead_letter_queue", :path=>"/usr/share/logstash/data/dead_letter_queue"}
[2021-01-05T07:24:56,707][INFO ][logstash.runner ] Starting Logstash {"logstash.version"=>"6.8.9"}
[2021-01-05T07:24:56,754][INFO ][logstash.agent ] No persistent UUID file found. Generating new UUID {:uuid=>"fa698f3d-11a6-4c08-a920-860e4873d1e5", :path=>"/usr/share/logstash/data/uuid"}
[2021-01-05T07:25:39,563][INFO ][logstash.pipeline ] Starting pipeline {:pipeline_id=>"main", "pipeline.workers"=>2, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>50}
warkolm
(Mark Walkom)
January 5, 2021, 7:22am
6
Does logstash
resolve to an actual IP though?
UjjwalBera
(Ujjwal Bera)
January 5, 2021, 7:30am
7
I have used 0.0.0.0 host.
Logtash & filebeat is same server and different container
system
(system)
Closed
February 2, 2021, 9:30am
8
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.