# "Failed to connect" error **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [August 13, 2018, 1:35pm UTC](https://discuss.elastic.co/t/failed-to-connect-error/144180 "2018-08-13T13:35:01Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![g.myznikov.tinkoff](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/g.myznikov.tinkoff/32/33582_2.png) [@g.myznikov.tinkoff](https://discuss.elastic.co/u/g.myznikov.tinkoff)\ **Post date:** [August 13, 2018, 1:35pm UTC](https://discuss.elastic.co/t/failed-to-connect-error/144180/1 "2018-08-13T13:35:01Z")
Hello! I've used ELK stack with filebeat on docker. There are my config file. elasticsearch.yml: ```auto path.data: /var/lib/elasticsearch path.logs: /var/log/elasticsearch network.host: 0.0.0.0 ``` kibana.yml: ```auto server.port: 5601 server.host: "127.0.0.1" xpack.security.enabled: false xpack.reporting.encryptionKey: "smth" elasticsearch.username: "user1" elasticsearch.password: "smth" ``` logstashpipeline.yml: ```auto input { beats { port => [5044] } } output { elasticsearch { hosts => "127.0.0.1:9200" index => "docker-one" manage_template => false } } ``` filebeat.yml: ```auto filebeat.inputs: - type: log enabled: true paths: - /testvar/*log - /testvar/**/*log output.elasticsearch: hosts: ["127.0.0.1:9200"] setup.kibana: host: "127.0.0.1:5601" ``` When I' ve run docker by command ```auto docker run -it --user=root -v /dockerfilebeat/filebeat.yml:/usr/share/filebeat/filebeat.yml -v /var/log:/testvar docker.elastic.co/beats/filebeat:6.3.1 ``` I've got errors like: ```auto 2018-08-13T13:33:04.376Z ERROR pipeline/output.go:74 Failed to connect: dial tcp 127.0.0.1:5044: getsockopt: connection refused ``` How can I escape this problem? ---
**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\ **Post date:** [August 13, 2018, 3:51pm UTC](https://discuss.elastic.co/t/failed-to-connect-error/144180/2 "2018-08-13T15:51:51Z")
What is your full setup with all config files and debug logs? In your `filebeat.yml` I can see that you are sending events to Elasticsearch. However, in your Logstash config you are expecting events from Beats. Also, the error message you shared says that you are trying to connect to port 5044 which is the "default Logstash" port. But I can't see anything about sending events to Logstash in your Beats config. Are you sure these are the config files you are actually running? ---
**Author:** ![g.myznikov.tinkoff](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/g.myznikov.tinkoff/32/33582_2.png) [@g.myznikov.tinkoff](https://discuss.elastic.co/u/g.myznikov.tinkoff)\ **Post date:** [August 14, 2018, 8:00am UTC](https://discuss.elastic.co/t/failed-to-connect-error/144180/3 "2018-08-14T08:00:22Z")
I've made a mistake. Actually my filebeat.yml is same exept output: ```auto output.logstash: hosts: ["127.0.0.1:5044"] ``` ---
**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\ **Post date:** [August 14, 2018, 8:15am UTC](https://discuss.elastic.co/t/failed-to-connect-error/144180/4 "2018-08-14T08:15:27Z")
Are you sure Logstash is running and reachable by Filebeat? Have you checked these contitions? [https://www.elastic.co/guide/en/beats/filebeat/current/faq.html#connection-problem](https://www.elastic.co/guide/en/beats/filebeat/current/faq.html#connection-problem) ---
**Author:** ![g.myznikov.tinkoff](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/g.myznikov.tinkoff/32/33582_2.png) [@g.myznikov.tinkoff](https://discuss.elastic.co/u/g.myznikov.tinkoff)\ **Post date:** [August 14, 2018, 9:15am UTC](https://discuss.elastic.co/t/failed-to-connect-error/144180/5 "2018-08-14T09:15:52Z")
I've just checked my ports: ```auto root@user-VirtualBox:~# telnet 127.0.0.1 5044 Trying 127.0.0.1... Connected to 127.0.0.1. Escape character is '^]'. Connection closed by foreign host. ``` Situation is same for 5601(Kibana) and 9200 (ElasticSearch) ---
**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\ **Post date:** [August 14, 2018, 9:25am UTC](https://discuss.elastic.co/t/failed-to-connect-error/144180/6 "2018-08-14T09:25:23Z")
Could you share the debug logs of Logstash and Beats? ---
**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\ **Post date:** [August 14, 2018, 11:49am UTC](https://discuss.elastic.co/t/failed-to-connect-error/144180/8 "2018-08-14T11:49:12Z")
Are ES, LS and FB in the same Docker image? If not have you exposed the correct ports? ---
**Author:** ![g.myznikov.tinkoff](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/g.myznikov.tinkoff/32/33582_2.png) [@g.myznikov.tinkoff](https://discuss.elastic.co/u/g.myznikov.tinkoff)\ **Post date:** [August 14, 2018, 12:05pm UTC](https://discuss.elastic.co/t/failed-to-connect-error/144180/9 "2018-08-14T12:05:03Z")
No, ES and LS installed on the Ubuntu 16.04 on virtual machine. And Docker started by docker image. I don't expose any ports for this image. ---
**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\ **Post date:** [August 14, 2018, 2:06pm UTC](https://discuss.elastic.co/t/failed-to-connect-error/144180/10 "2018-08-14T14:06:21Z")
Could you tell me more about the setup? Are LS and ES on the same VM? Is Filebeat hosted on a separate VM? ---
**Author:** ![g.myznikov.tinkoff](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/g.myznikov.tinkoff/32/33582_2.png) [@g.myznikov.tinkoff](https://discuss.elastic.co/u/g.myznikov.tinkoff)\ **Post date:** [August 14, 2018, 3:29pm UTC](https://discuss.elastic.co/t/failed-to-connect-error/144180/11 "2018-08-14T15:29:10Z")
Of course. LS and ES work on the same VM. On that machine I starting Docker image of FB. ---
**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\ **Post date:** [August 15, 2018, 3:40pm UTC](https://discuss.elastic.co/t/failed-to-connect-error/144180/12 "2018-08-15T15:40:11Z")
Have you configured the networking of the container to make sure you can reach the localhost of the host machine? To me it seems like a Docker issue, not ELKB problem. After searching on the internet, I discovered this question on SO: [https://stackoverflow.com/questions/24319662/from-inside-of-a-docker-container-how-do-i-connect-to-the-localhost-of-the-mach](https://stackoverflow.com/questions/24319662/from-inside-of-a-docker-container-how-do-i-connect-to-the-localhost-of-the-mach) According to the solution here, you need to add `--net=host` to the `docker` command you run. This lets your container to connect to the host's localhost. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 12, 2018, 3:40pm UTC](https://discuss.elastic.co/t/failed-to-connect-error/144180/13 "2018-09-12T15:40:15Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.