Error when connecting filebeat to logstash

Elastic Stack Beats
1

Hello everyone

I have a docker container with logstash running behind an nginx proxy on ubuntu 15 and would like to send information via filebeat from an OS X 10.11 client to logstash.

I can connect to logstash using telnet but filebeat is giving me the following error:
single.go:76: INFO Error publishing events (retrying): lumberjack protocol error

These are my configurations:

filebeat.yml
output: logstash: hosts: - my.logstashserver:443 timeout: 15

logstash.conf
input { beats { host => "0.0.0.0" port => 5044 } }

nginx
` server {
listen 443 ssl;
server_name my.logstashserve;

ssl on;
ssl_certificate mycert;
ssl_certificate_key mykey;

 location / {
     proxy_pass http://logstash.local/;
 }

}`

What am I missing?

2

Where are you defining that nginx should pass the logs to port 5044, I read your configuration to mean it would pass it to port 80 (http). Might need to try

proxy_pass http://logstash.local:5044;
3

beats protocol is not based on HTTP or compatible to HTTP. If you need a proxy, you will require a TCP-based proxy, as beats->logstash is long lived connection. You need ssl/tls support, configure TLS in logstash and filebeat.

4

Thank you both very much for your reply. I forgot to copy my entire nginx configuration into my question. I do actually redirect to the correct port.

But after coming back to the problem I realised, that there is no need to proxy logstash this way. I now have port 5044 open and use a secure tls connection -as steffens suggested.

Thanks again for the help.