Failed connection to Logstash machine

[erion]

Hi,
i have filebeat.yml:

filebeat.prospectors:
-input_type: log
path:

• /mnt/analisilog/www.access_log
  output.logstash:
  hosts: ["52.24.17.29:5044"]

and logstash.conf

input {
beats {
port => 5044
host => "54.26.43.27 }
}
output {
stdout {
codec => dots {}
}

elasticsearch {
hosts => ["https://search-analisilog-
kmynofy.eu-west-1.es.amazonaws.com"]
index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
document_type => "%{[@metadata][type]}"
}
}

when i run filebeat send me error message:

2017/07/06 08:42:36.608751 metrics.go:34: INFO No non-zero metrics in the last 30s
2017/07/06 08:43:06.608836 metrics.go:34: INFO No non-zero metrics in the last 30s
2017/07/06 08:43:36.608856 metrics.go:34: INFO No non-zero metrics in the last 30s

Thanks for help.

[exekias (Carlos Pérez Aradros)]

Uhm,

host field doesn't seem to be the same? You have 54.26.43.27 in logstash and 52.24.17.29 in filebeat. Also I think there is a spurious " in the host for logstash conf

[erion]

Hi @exekias for filebeat i use ip: 54.26.43.27 and for logstash i use: 52.24.17.29. I'm sorry i've missed the second spurious but there is. I use for filebeat and logstash two different virtual machine.
Thanks for replay

[exekias (Carlos Pérez Aradros)]

Check logstash doc for beats input:
https://www.elastic.co/guide/en/logstash/current/plugins-inputs-beats.html#plugins-inputs-beats-host

host field is the IP address to listen on, it's optional so if you don't define it, it will listen in all interfaces. If you define it you must definitely use logstash node IP, not filebeat's

Please check if that fixes your issue, I think it should

Best regards

[erion]

Hi @exekias it isn't the config but policy question of my machine so i decided to do the first try without logstash.
But when i try load data in elasticsearch give me error.
The filebeat.yml:

filebeat.prospectors:
-input_type: log
paths:

• /mnt/analisilog/www.access_log
  output.elasticsearch:
  hosts: ["search-analisilog-k2wpmymdimywzrcmyogbrfy.eu-west-1.es.amazonaws.com:443"]
  protocol: "https"
  template.name: "filebeat"
  template.path: "./filebeat.template.json"
  template.overwrite: true

the filebeat.template.json

{
"mappings": {
"default": {
"_all": {
"enabled": true,
"norms": {
"enabled": false
}
},
"dynamic_templates": [
{
"template1": {
"mapping": {
"doc_values": true,
"ignore_above": 1024,
"index": "not_analyzed",
"type": "{dynamic_type}"
},
"match": ""
}
}
],
"properties": {
"timestamp": {
"type": "date"
},
"message": {
"type": "string",
"index": "analyzed"
},
"line": {
"type": "integer",
"doc_values": "true"
},
"offset": {
"type": "integer",
"doc_values": "true"
}
],
"properties": {
"timestamp": {
"type": "date"
},
"message": {
"type": "string",
"index": "analyzed"
},
"line": {
"type": "integer",
"doc_values": "true"
},
"offset": {
"type": "integer",
"doc_values": "true"
}
}
}
},
"settings": {
"index.refresh_interval": "5s"
},
"template": "filebeat-"
}

following the documentation send me this error. Can you help me?

2017/07/11 08:18:10.252056 metrics.go:34: INFO No non-zero metrics in the last 30s
2017/07/11 08:18:40.251944 metrics.go:34: INFO No non-zero metrics in the last 30s

Thanks a lot