# FB connection timed out

**URL:** <https://discuss.elastic.co/t/fb-connection-timed-out/119326>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [February 10, 2018, 3:59am UTC](https://discuss.elastic.co/t/fb-connection-timed-out/119326 "2018-02-10T03:59:35Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Medard\_Rebero](https://avatars.discourse-cdn.com/v4/letter/m/bc79bd/32.png) [@Medard\_Rebero](https://discuss.elastic.co/u/Medard_Rebero)\
**Post date:** [February 10, 2018, 3:59am UTC](https://discuss.elastic.co/t/fb-connection-timed-out/119326/1 "2018-02-10T03:59:35Z")

</div>

I am struggling so badly with this issue. I am trying to use filebeat to send logs to logstash and I get this kind of error:

```
2018-02-10T04:27:51.356+0100 INFO [monitoring] log/log.go:124 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":5550,"time":5554},"total":{"ticks":14330,"time":14334,"value":14330},"user":{"ticks":8780,"time":8780}},"info":{"ephemeral_id":"8fe71630-faed-4$
2018-02-10T04:28:21.355+0100 INFO [monitoring] log/log.go:124 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":5550,"time":5557},"total":{"ticks":14350,"time":14360,"value":14350},"user":{"ticks":8800,"time":8803}},"info":{"ephemeral_id":"8fe71630-faed-4$
2018-02-10T04:28:28.014+0100 ERROR pipeline/output.go:74 Failed to connect: dial tcp 192.162.71.162:5044: getsockopt: connection timed out

```

I have 3 servers. One hosts ELS and LS, and two others are clients. One of the clients is sending logs correctly and another does not.  
The difference between both clients is that the one working fine runs on Debian 9 whereas the failing one runs on Centos 7. LS and ELS are hosted on Debian 8

Filebeat config on both clients:

```
output.logstash:
  # The Logstash hosts
 hosts: ["myserverip:5044"]

```

LS config:

```
input {
     beats {
       port => 5044
       ssl => false
       ssl_certificate => "/etc/ssl/logstash/logstash.crt"
       ssl_key => "/etc/ssl/logstash/logstash.key"
      }
    }

output {
  elasticsearch {
    hosts => localhost
    index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
  }
  stdout {
    codec => rubydebug
  }
}

filter {
      grok {
        match => { "message" => "%{COMBINEDAPACHELOG}" }
      }
      geoip {
         source => "clientip"
      }
    }

```

No SSL, all ELS, LS and FB are latest versions: 6.x

Any help?

---

<div class="post-metadata">

**Author:** ![Medard\_Rebero](https://avatars.discourse-cdn.com/v4/letter/m/bc79bd/32.png) [@Medard\_Rebero](https://discuss.elastic.co/u/Medard_Rebero)\
**Post date:** [February 12, 2018, 10:21am UTC](https://discuss.elastic.co/t/fb-connection-timed-out/119326/2 "2018-02-12T10:21:07Z")

</div>

As I could not find a solution, I removed LS and used FB and ELS directly. It seems to work just fine.

---

<div class="post-metadata">

**Author:** ![tudor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tudor/32/3753_2.png) [@tudor](https://discuss.elastic.co/u/tudor)\
**Post date:** [February 12, 2018, 11:02am UTC](https://discuss.elastic.co/t/fb-connection-timed-out/119326/3 "2018-02-12T11:02:05Z")

</div>

If you're still interested in figuring it out, can you try from the Filebeat machine:

`filebeat test output`

And give us the result?

---

<div class="post-metadata">

**Author:** ![Medard\_Rebero](https://avatars.discourse-cdn.com/v4/letter/m/bc79bd/32.png) [@Medard\_Rebero](https://discuss.elastic.co/u/Medard_Rebero)\
**Post date:** [February 12, 2018, 4:21pm UTC](https://discuss.elastic.co/t/fb-connection-timed-out/119326/4 "2018-02-12T16:21:12Z")

</div>

Thanks Tudor! I have abandoned LS for, and I noticed that I would have had to leave it anyway due to other applications that need to connect to ELS directly from remote.

Thanks again for your kind intervention.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 12, 2018, 4:21pm UTC](https://discuss.elastic.co/t/fb-connection-timed-out/119326/5 "2018-03-12T16:21:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.