Filebeat and Logstash connection refused error

Elastic Stack Beats
1

Hi !

I am trying to send the logs to logstash using filebeats
I'm getting this error

I ran the commands :

  1. sudo /etc/init.d/filebeat start and then after I ran

  2. ./filebeat -e -v -c filebeat.yml

    2017/07/27 19:57:19.811895 beat.go:285: INFO Home path: [/home/dotisandhyarani/Downloads/filebeat-5.5.1-linux-x86_64] Config path: [/home/dotisandhyarani/Downloads/filebeat-5.5.1-linux-x86_64] Data path: [/home/dotisandhyarani/Downloads/filebeat-5.5.1-linux-x86_64/data] Logs path: [/home/dotisandhyarani/Downloads/filebeat-5.5.1-linux-x86_64/logs]
    2017/07/27 19:57:19.811943 beat.go:186: INFO Setup Beat: filebeat; Version: 5.5.1
    2017/07/27 19:57:19.811996 metrics.go:23: INFO Metrics logging every 30s
    2017/07/27 19:57:19.812056 logstash.go:90: INFO Max Retries set to: 3
    2017/07/27 19:57:19.812132 outputs.go:108: INFO Activated logstash as output plugin.
    2017/07/27 19:57:19.812227 publish.go:295: INFO Publisher name: sdoti-OptiPlex-9010
    2017/07/27 19:57:19.812444 async.go:63: INFO Flush Interval set to: 1s
    2017/07/27 19:57:19.812464 async.go:64: INFO Max Bulk Size set to: 2048
    2017/07/27 19:57:19.812785 beat.go:221: INFO filebeat start running.
    2017/07/27 19:57:19.812835 registrar.go:85: INFO Registry file set to: /home/dotisandhyarani/Downloads/filebeat-5.5.1-linux-x86_64/data/registry
    2017/07/27 19:57:19.812896 registrar.go:106: INFO Loading registrar data from /home/dotisandhyarani/Downloads/filebeat-5.5.1-linux-x86_64/data/registry
    2017/07/27 19:57:19.812950 registrar.go:123: INFO States Loaded from registrar: 0
    2017/07/27 19:57:19.812996 crawler.go:38: INFO Loading Prospectors: 1
    2017/07/27 19:57:19.813086 registrar.go:236: INFO Starting Registrar
    2017/07/27 19:57:19.813155 prospector_log.go:65: INFO Prospector with previous states loaded: 0
    2017/07/27 19:57:19.813136 sync.go:41: INFO Start sending events to output
    2017/07/27 19:57:19.813214 spooler.go:63: INFO Starting spooler: spool_size: 2048; idle_timeout: 5s
    2017/07/27 19:57:19.813249 prospector.go:124: INFO Starting prospector of type: log; id: 15345013899043771739
    2017/07/27 19:57:19.813271 crawler.go:58: INFO Loading and starting Prospectors completed. Enabled prospectors: 1
    2017/07/27 19:57:19.813764 log.go:91: INFO Harvester started for file: /home/dotisandhyarani/Downloads/logstash-5.4.1/bin/test_small.log
    2017/07/27 19:57:19.813813 log.go:91: INFO Harvester started for file: /home/dotisandhyarani/Downloads/logstash-5.4.1/bin/dmc_server1.log
    2017/07/27 19:57:19.813985 log.go:91: INFO Harvester started for file: /home/dotisandhyarani/Downloads/logstash-5.4.1/bin/test_exceptions.log
    2017/07/27 19:57:19.813993 log.go:91: INFO Harvester started for file: /home/dotisandhyarani/Downloads/logstash-5.4.1/bin/test_m8.log
    2017/07/27 19:57:19.847214 single.go:140: ERR Connecting error publishing events (retrying): dial tcp 127.0.0.1:5044: getsockopt: connection refused
    2017/07/27 19:57:20.847648 single.go:140: ERR Connecting error publishing events (retrying): dial tcp 127.0.0.1:5044: getsockopt: connection refused
    2017/07/27 19:57:22.848110 single.go:140: ERR Connecting error publishing events (retrying): dial tcp 127.0.0.1:5044: getsockopt: connection refused
    2017/07/27 19:57:26.848534 single.go:140: ERR Connecting error publishing events (retrying): dial tcp 127.0.0.1:5044: getsockopt: connection refused
    2017/07/27 19:57:34.848915 single.go:140: ERR Connecting error publishing events (retrying): dial tcp 127.0.0.1:5044: getsockopt: connection refused
    2017/07/27 19:57:49.812350 metrics.go:39: INFO Non-zero metrics in the last 30s: filebeat.harvester.open_files=4 filebeat.harvester.running=4 filebeat.harvester.started=4 libbeat.publisher.published_events=2044

I understood there is a connection problem between filebeat and logstash
Could any one help with this?

Thanks!

2

Hello,

Can you post your logstash pipeline to receive this input and the logstash log to see if the listener started? And also your filebeat configuration?

Your filebeat output should be something like that.

output.logstash:
  hosts: ["127.0.0.1:5044"]

Your input in the logstash configuration should be something like that.

input {
    beats {
        port => 5044
    }
}

Are the configurations like the ones above?

1 Like
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.