# Errors when connecting Filebeat to logstash

**URL:** <https://discuss.elastic.co/t/errors-when-connecting-filebeat-to-logstash/92835>\
**Category:** Logstash\
**Created:** [July 12, 2017, 3:29pm UTC](https://discuss.elastic.co/t/errors-when-connecting-filebeat-to-logstash/92835 "2017-07-12T15:29:32Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![Baco](https://avatars.discourse-cdn.com/v4/letter/b/94ad74/32.png) [@Baco](https://discuss.elastic.co/u/Baco)\
**Post date:** [July 12, 2017, 3:29pm UTC](https://discuss.elastic.co/t/errors-when-connecting-filebeat-to-logstash/92835/1 "2017-07-12T15:29:32Z")

</div>

Hello,

Would you like to help me understand why i have errors below when I try to connect filebeat to logstash.

An unexpected error occurred! {:error=\>#\<NoMethodError: undefined method `<=' for nil:NilClass>, :backtrace=>["(eval):145:in`output\_func'", "/etc/Elastic\_Stack/logstash-5.4.0/logstash-core/lib/logstash/pipeline.rb:400:in `output_batch'", "org/jruby/RubyProc.java:281:in`call'", "/etc/Elastic\_Stack/logstash-5.4.0/logstash-core/lib/logstash/util/wrapped\_synchronous\_queue.rb:224:in `each'", "org/jruby/RubyHash.java:1342:in`each'", "/etc/Elastic\_Stack/logstash-5.4.0/logstash-core/lib/logstash/util/wrapped\_synchronous\_queue.rb:223:in `each'", "/etc/Elastic_Stack/logstash-5.4.0/logstash-core/lib/logstash/pipeline.rb:394:in`output\_batch'", "/etc/Elastic\_Stack/logstash-5.4.0/logstash-core/lib/logstash/pipeline.rb:352:in `worker_loop'", "/etc/Elastic_Stack/logstash-5.4.0/logstash-core/lib/logstash/pipeline.rb:317:in`start\_workers'"]}

---

<div class="post-metadata">

**Author:** ![tatdat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tatdat/32/113160_2.png) [@tatdat](https://discuss.elastic.co/u/tatdat)\
**Post date:** [July 12, 2017, 3:33pm UTC](https://discuss.elastic.co/t/errors-when-connecting-filebeat-to-logstash/92835/2 "2017-07-12T15:33:01Z")

</div>

What are your config logstash and filebeat looklike ?

---

<div class="post-metadata">

**Author:** ![Baco](https://avatars.discourse-cdn.com/v4/letter/b/94ad74/32.png) [@Baco](https://discuss.elastic.co/u/Baco)\
**Post date:** [July 13, 2017, 8:11am UTC](https://discuss.elastic.co/t/errors-when-connecting-filebeat-to-logstash/92835/3 "2017-07-13T08:11:32Z")

</div>

Thanks @tatdat for your answer,

The change i have done in filebeat are:  
paths:  
#- /var/log/\*.log  
- /var/log/suricata/eve.json

output.logstash:

# The Logstash hosts

hosts: ["192.168.1.10:5044"]

The logstash file is :  
input {  
file {  
type =\> "Local\_Log"  
path =\> "/var/log/\*.log"  
}

```
    beats {
    port => 5044
    codec => json
    }

```

}  
output {  
stdout {  
codec =\> rubydebug  
}  
}

---

<div class="post-metadata">

**Author:** ![tatdat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tatdat/32/113160_2.png) [@tatdat](https://discuss.elastic.co/u/tatdat)\
**Post date:** [July 13, 2017, 8:36am UTC](https://discuss.elastic.co/t/errors-when-connecting-filebeat-to-logstash/92835/4 "2017-07-13T08:36:06Z")

</div>

Do you have any config another?

I'm looking in your config, it's very simple and dont have problem in your logstash config ..  
But I saw in error log , have error

> undefined method `\<='

May be have error in condition (filter) in logstash?. Im not sure

---

<div class="post-metadata">

**Author:** ![Baco](https://avatars.discourse-cdn.com/v4/letter/b/94ad74/32.png) [@Baco](https://discuss.elastic.co/u/Baco)\
**Post date:** [July 13, 2017, 8:56am UTC](https://discuss.elastic.co/t/errors-when-connecting-filebeat-to-logstash/92835/5 "2017-07-13T08:56:59Z")

</div>

Hello,

No I haven't another config.

If I comment plugin beats, everything work normaly.

---

<div class="post-metadata">

**Author:** ![tatdat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tatdat/32/113160_2.png) [@tatdat](https://discuss.elastic.co/u/tatdat)\
**Post date:** [July 13, 2017, 9:08am UTC](https://discuss.elastic.co/t/errors-when-connecting-filebeat-to-logstash/92835/6 "2017-07-13T09:08:28Z")

</div>

I found it @Baco : `"json"` not `json`

```
    beats {
        port => 5044
        codec => "json"
    }

```

Tell me know if it worked 🙂

---

<div class="post-metadata">

**Author:** ![Baco](https://avatars.discourse-cdn.com/v4/letter/b/94ad74/32.png) [@Baco](https://discuss.elastic.co/u/Baco)\
**Post date:** [July 13, 2017, 9:43am UTC](https://discuss.elastic.co/t/errors-when-connecting-filebeat-to-logstash/92835/7 "2017-07-13T09:43:22Z")

</div>

Hello @tatdat

I change this but no change to the problem. I think codec is not mandatory in plugin beats.

The error in filebeat computer is:

2017/07/13 09:39:00.037221 sync.go:85: ERR Failed to publish events caused by: read tcp 192.168.1.110:38854-\>192.168.1.10:5044: read: connection reset by peer

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 10, 2017, 9:43am UTC](https://discuss.elastic.co/t/errors-when-connecting-filebeat-to-logstash/92835/8 "2017-08-10T09:43:44Z")

</div>

Closed on August 10, 2017, 9:43am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.