Error when connecting filebeat to logstash

Hello everyone

I have a docker container with logstash running behind an nginx proxy on ubuntu 15 and would like to send information via filebeat from an OS X 10.11 client to logstash.

I can connect to logstash using telnet but filebeat is giving me the following error:
single.go:76: INFO Error publishing events (retrying): lumberjack protocol error

These are my configurations:

output: logstash: hosts: - my.logstashserver:443 timeout: 15

input { beats { host => "" port => 5044 } }

` server {
listen 443 ssl;
server_name my.logstashserve;

ssl on;
ssl_certificate mycert;
ssl_certificate_key mykey;

 location / {
     proxy_pass http://logstash.local/;


What am I missing?

Where are you defining that nginx should pass the logs to port 5044, I read your configuration to mean it would pass it to port 80 (http). Might need to try

proxy_pass http://logstash.local:5044;

beats protocol is not based on HTTP or compatible to HTTP. If you need a proxy, you will require a TCP-based proxy, as beats->logstash is long lived connection. You need ssl/tls support, configure TLS in logstash and filebeat.

Thank you both very much for your reply. I forgot to copy my entire nginx configuration into my question. I do actually redirect to the correct port.

But after coming back to the problem I realised, that there is no need to proxy logstash this way. I now have port 5044 open and use a secure tls connection -as steffens suggested.

Thanks again for the help.