Expose logstash API to host

Elastic Stack Logstash
1

I am running Logstash 5.5 in a docker container. Since Logstash API binds to port 9600, i expose the port in the container hoping to access API endpoints from the host. Also, i am running metricbeat on the host to collect logstash stats.

$ docker ps

CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
999b11cdd236 ccur/logstash:latest "/docker-entrypoin..." About an hour ago Up About an hour 0.0.0.0:5044->5044/tcp, 0.0.0.0:9600->9600/tcp, 0.0.0.0:5001->5000/tcp logstash

I am unable to access the api from host. I get the following error from metricbeat

"message": "error making http request: Get http://10.76.144.21:9600/_node/stats: dial tcp 10.76.144.21:9600: getsockopt: connection refused"

Even, a simple curl command fails.
$ curl -XGET '127.0.0.1:9600/_node/stats?pretty'
curl: (56) Recv failure: Connection reset by peer

Any pointers would be appreciated.

2

Are you using one of the official Logstash distributions for Docker, or are you building your own?

By default, the Logstash API binds only to the local loopback interface (e.g., 127.0.0.1), and not to external interfaces.

The Elastic-provided docker distribution binds to all interfaces via 0.0.0.0; if you're dockerising your own, you can set http.host as we do.

A warning, though: the API binds to local loopback for security reasons; as an unsecured localhost-only API, it is not subject to as much security-related scrutiny while in development. I would strongly advise limiting its exposure via your network as much as is reasonable.

1 Like
3

Brilliant. That worked like a charm. Thanks!

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.