Filebeat and Logstash connection refused error

[SandhyaRani]

Hi !

I am trying to send the logs to logstash using filebeats
I'm getting this error

I ran the commands :

1. sudo /etc/init.d/filebeat start and then after I ran

2. ./filebeat -e -v -c filebeat.yml

   2017/07/27 19:57:19.811895 beat.go:285: INFO Home path: [/home/dotisandhyarani/Downloads/filebeat-5.5.1-linux-x86_64] Config path: [/home/dotisandhyarani/Downloads/filebeat-5.5.1-linux-x86_64] Data path: [/home/dotisandhyarani/Downloads/filebeat-5.5.1-linux-x86_64/data] Logs path: [/home/dotisandhyarani/Downloads/filebeat-5.5.1-linux-x86_64/logs]
   2017/07/27 19:57:19.811943 beat.go:186: INFO Setup Beat: filebeat; Version: 5.5.1
   2017/07/27 19:57:19.811996 metrics.go:23: INFO Metrics logging every 30s
   2017/07/27 19:57:19.812056 logstash.go:90: INFO Max Retries set to: 3
   2017/07/27 19:57:19.812132 outputs.go:108: INFO Activated logstash as output plugin.
   2017/07/27 19:57:19.812227 publish.go:295: INFO Publisher name: sdoti-OptiPlex-9010
   2017/07/27 19:57:19.812444 async.go:63: INFO Flush Interval set to: 1s
   2017/07/27 19:57:19.812464 async.go:64: INFO Max Bulk Size set to: 2048
   2017/07/27 19:57:19.812785 beat.go:221: INFO filebeat start running.
   2017/07/27 19:57:19.812835 registrar.go:85: INFO Registry file set to: /home/dotisandhyarani/Downloads/filebeat-5.5.1-linux-x86_64/data/registry
   2017/07/27 19:57:19.812896 registrar.go:106: INFO Loading registrar data from /home/dotisandhyarani/Downloads/filebeat-5.5.1-linux-x86_64/data/registry
   2017/07/27 19:57:19.812950 registrar.go:123: INFO States Loaded from registrar: 0
   2017/07/27 19:57:19.812996 crawler.go:38: INFO Loading Prospectors: 1
   2017/07/27 19:57:19.813086 registrar.go:236: INFO Starting Registrar
   2017/07/27 19:57:19.813155 prospector_log.go:65: INFO Prospector with previous states loaded: 0
   2017/07/27 19:57:19.813136 sync.go:41: INFO Start sending events to output
   2017/07/27 19:57:19.813214 spooler.go:63: INFO Starting spooler: spool_size: 2048; idle_timeout: 5s
   2017/07/27 19:57:19.813249 prospector.go:124: INFO Starting prospector of type: log; id: 15345013899043771739
   2017/07/27 19:57:19.813271 crawler.go:58: INFO Loading and starting Prospectors completed. Enabled prospectors: 1
   2017/07/27 19:57:19.813764 log.go:91: INFO Harvester started for file: /home/dotisandhyarani/Downloads/logstash-5.4.1/bin/test_small.log
   2017/07/27 19:57:19.813813 log.go:91: INFO Harvester started for file: /home/dotisandhyarani/Downloads/logstash-5.4.1/bin/dmc_server1.log
   2017/07/27 19:57:19.813985 log.go:91: INFO Harvester started for file: /home/dotisandhyarani/Downloads/logstash-5.4.1/bin/test_exceptions.log
   2017/07/27 19:57:19.813993 log.go:91: INFO Harvester started for file: /home/dotisandhyarani/Downloads/logstash-5.4.1/bin/test_m8.log
   2017/07/27 19:57:19.847214 single.go:140: ERR Connecting error publishing events (retrying): dial tcp 127.0.0.1:5044: getsockopt: connection refused
   2017/07/27 19:57:20.847648 single.go:140: ERR Connecting error publishing events (retrying): dial tcp 127.0.0.1:5044: getsockopt: connection refused
   2017/07/27 19:57:22.848110 single.go:140: ERR Connecting error publishing events (retrying): dial tcp 127.0.0.1:5044: getsockopt: connection refused
   2017/07/27 19:57:26.848534 single.go:140: ERR Connecting error publishing events (retrying): dial tcp 127.0.0.1:5044: getsockopt: connection refused
   2017/07/27 19:57:34.848915 single.go:140: ERR Connecting error publishing events (retrying): dial tcp 127.0.0.1:5044: getsockopt: connection refused
   2017/07/27 19:57:49.812350 metrics.go:39: INFO Non-zero metrics in the last 30s: filebeat.harvester.open_files=4 filebeat.harvester.running=4 filebeat.harvester.started=4 libbeat.publisher.published_events=2044

I understood there is a connection problem between filebeat and logstash
Could any one help with this?

Thanks!

[leandrojmp (Leandro Pereira)]

Hello,

Can you post your logstash pipeline to receive this input and the logstash log to see if the listener started? And also your filebeat configuration?

Your filebeat output should be something like that.

output.logstash:
  hosts: ["127.0.0.1:5044"]

Your input in the logstash configuration should be something like that.

input {
    beats {
        port => 5044
    }
}

Are the configurations like the ones above?