# Filebeat and logstash-shipper

**URL:** <https://discuss.elastic.co/t/filebeat-and-logstash-shipper/117487>\
**Category:** Logstash\
**Created:** [January 29, 2018, 3:45pm UTC](https://discuss.elastic.co/t/filebeat-and-logstash-shipper/117487 "2018-01-29T15:45:25Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![ggutsche](https://avatars.discourse-cdn.com/v4/letter/g/aca169/32.png) [@ggutsche](https://discuss.elastic.co/u/ggutsche)\
**Post date:** [January 29, 2018, 3:45pm UTC](https://discuss.elastic.co/t/filebeat-and-logstash-shipper/117487/1 "2018-01-29T15:45:25Z")

</div>

Hi!

I try to integrate some new stages to our older ELK-Stack. For the new stages I would like to use filebeat and I want to connect to the logstash-shipper. But I get the error message from filebeat

```
18/01/29 15:35:13.061640 client.go:194: DBG handle error: read tcp <filebeat-ip>:52566-><logstash-shipper-host-ip>:5644: i/o timeout
2018/01/29 15:35:13.061707 sync.go:78: DBG 0 events out of 2034 events sent to logstash. Continue sending
2018/01/29 15:35:13.061720 sync.go:58: DBG close connection
2018/01/29 15:35:13.061730 client.go:110: DBG closing
2018/01/29 15:35:13.061838 sync.go:85: ERR Failed to publish events caused by: read tcp <filebeat-ip>:52566-><logstash-shipper-host-ip>:5644: i/o timeout
2018/01/29 15:35:13.061859 single.go:91: INFO Error publishing events (retrying): read tcp <filebeat-ip>:52566-><logstash-shipper-host-ip>:5644: i/o timeout
2018/01/29 15:35:13.061870 sync.go:58: DBG close connection
2018/01/29 15:35:13.061879 single.go:156: DBG send fail
2018/01/29 15:35:14.062132 sync.go:53: DBG connect
2018/01/29 15:35:14.137294 sync.go:107: DBG Try to publish 2034 events to logstash with window size 5
2018/01/29 15:35:14.140788 client.go:194: DBG handle error: EOF
2018/01/29 15:35:14.140818 client.go:110: DBG closing
2018/01/29 15:35:14.140911 sync.go:78: DBG 0 events out of 2034 events sent to logstash. Continue sending
2018/01/29 15:35:14.140926 sync.go:58: DBG close connection
2018/01/29 15:35:14.140938 sync.go:85: ERR Failed to publish events caused by: EOF
2018/01/29 15:35:14.140949 single.go:91: INFO Error publishing events (retrying): EOF
2018/01/29 15:35:14.140958 sync.go:58: DBG close connection
2018/01/29 15:35:14.140966 single.go:156: DBG send fail

```

My Filebeat.yml:

```
filebeat.prospectors:
- input_type: log
  paths:
      - /vol1/app1-prod1_i01_4001/log/*.log
      - /vol1/app1-prod1_i02_4002/log/*.log
   fields:
     log_type: "app1log"
     environment: "prod"
   exclude_files: [".gz$"]

 - input_type: log
   paths:
        - /vol1/app2-prod1_i01_6001/log/*.log
        - /vol1/app2-prod1_i02_6002/log/*.log
  symlinks: true
  fields:
       log_type: "2falog"
       environment: "prod"
   exclude_files: [".gz$"]
output.logstash:
    hosts: ["logstash-shipper-host:5644"]
    ssl:
               certificate_authorities: ["/etc/filebeat/logstash-forwarder.crt"]
    timeout: 30

```

My logstash-shipper.conf:

```
input {
    lumberjack {
        port => 5644
        type => "ljack"
        ssl_certificate => "/etc/pki/logstash/certs/logstash-forwarder.crt"
        ssl_key => "/etc/pki/logstash/private/logstash-forwarder.key"
    }
}
output {
    redis {
    host => "localhost"
    port => 6379
    batch => true
    batch_events => 1024
    batch_timeout => 10
    congestion_interval => 1
    congestion_threshold => 20000000
    data_type => "list"
    db => 0
    key => "logstash"
  }

```

}

Is it even possible connect filebeat with logstash-shipper? If is it, what is my problem?

Greeting

Georg

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [January 29, 2018, 3:54pm UTC](https://discuss.elastic.co/t/filebeat-and-logstash-shipper/117487/2 "2018-01-29T15:54:23Z")

</div>

Use a beats input on the Logstash side instead of an a lumberjack input.

---

<div class="post-metadata">

**Author:** ![ggutsche](https://avatars.discourse-cdn.com/v4/letter/g/aca169/32.png) [@ggutsche](https://discuss.elastic.co/u/ggutsche)\
**Post date:** [January 29, 2018, 3:56pm UTC](https://discuss.elastic.co/t/filebeat-and-logstash-shipper/117487/3 "2018-01-29T15:56:47Z")

</div>

That is not possible. I must use lumberjack. I can only work on the client side

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [January 29, 2018, 4:00pm UTC](https://discuss.elastic.co/t/filebeat-and-logstash-shipper/117487/4 "2018-01-29T16:00:42Z")

</div>

Well, Filebeat isn't compatible with the lumberjack input.

---

<div class="post-metadata">

**Author:** ![ggutsche](https://avatars.discourse-cdn.com/v4/letter/g/aca169/32.png) [@ggutsche](https://discuss.elastic.co/u/ggutsche)\
**Post date:** [January 29, 2018, 4:07pm UTC](https://discuss.elastic.co/t/filebeat-and-logstash-shipper/117487/5 "2018-01-29T16:07:42Z")

</div>

thank you for your replay!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 26, 2018, 4:07pm UTC](https://discuss.elastic.co/t/filebeat-and-logstash-shipper/117487/6 "2018-02-26T16:07:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.