# Error sending files from filebeat via logstash

**URL:** <https://discuss.elastic.co/t/error-sending-files-from-filebeat-via-logstash/67717>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [December 1, 2016, 6:27am UTC](https://discuss.elastic.co/t/error-sending-files-from-filebeat-via-logstash/67717 "2016-12-01T06:27:22Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![aparadka](https://avatars.discourse-cdn.com/v4/letter/a/839c29/32.png) [@aparadka](https://discuss.elastic.co/u/aparadka)\
**Post date:** [December 1, 2016, 6:27am UTC](https://discuss.elastic.co/t/error-sending-files-from-filebeat-via-logstash/67717/1 "2016-12-01T06:27:22Z")

</div>

I tried sending the file from filebeat via logstash with the logstash output enabled in filebeat.yml files. After starting filebeat, it starts the harvester and gives the following error

![](https://us1.discourse-cdn.com/elastic/original/2X/f/f6afb2c5c6c1c9bab6b20c40c0e3d8217fbaca9a.png)

Can you suggest a soultion for this?

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [December 2, 2016, 3:39pm UTC](https://discuss.elastic.co/t/error-sending-files-from-filebeat-via-logstash/67717/2 "2016-12-02T15:39:33Z")

</div>

Can you please share the Filebeat and Logstash configs you are using and describe the setup more (versions used, are FB and LS on same host, what OSes).

Can you telnet to the Logstash port from the Filebeat host? Have you checked if there is a firewall (the "actively refused" part makes me think it's a firewall).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 30, 2016, 3:39pm UTC](https://discuss.elastic.co/t/error-sending-files-from-filebeat-via-logstash/67717/3 "2016-12-30T15:39:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
