Dear colleagues,
Version: 7.9.x
I have two instances of Filebeat (docker, rpm in localhost), none can connect to Logstash (docker).
I searched on similar topics and tried solutions, but still cannot reach safe port.
These are my settings:
filebeat.yml
filebeat.inputs:
- type: log
enabled: true
paths:
- /tmp/logs/*/*.log
# output.elasticsearch:
# index: filebeat
# hosts: [ "elasticsearch:9200" ]
# username: elastic
# password: changeme
output:
logstash:
enabled: true
hosts: [ "logstash:5044" ]
compression_level: 3
ssl:
enabled: false
ttl: 30s
backoff:
init: 3s
setup:
kibana:
host: "kibana:5601"
username: elastic
password: changeme
ilm:
enabled: auto
overwrite: true
rollover_alias: "filebeat-%{[agent.version]}"
pattern: "{now/d}-000001"
policy_name: "my-policy"
template:
overwrite: true
name: "filebeat-%{[agent.version]}"
pattern: "filebeat-%{[agent.version]}-*"
output:
elasticsearch:
username: elastic
password: changeme
logstash.yml
---
## Default Logstash configuration from logstash-docker.
## from https://github.com/elastic/logstash-docker/blob/master/build/logstash/config/logstash-full.yml
#
http.host: "0.0.0.0"
#path.config: /usr/share/logstash/pipeline
monitoring.elasticsearch.hosts: http://elasticsearch:9200
## X-Pack security credentials
#
monitoring.elasticsearch.username: elastic
monitoring.elasticsearch.password: changeme # unset by default. see:
# https://www.elastic.co/guide/en/logstash/current/ls-security.html#ls-monitoring-user
## PIPELINE CONFIGURATION
xpack.management.enabled: true
xpack.management.elasticsearch.hosts: http://elasticsearch:9200
xpack.management.elasticsearch.username: logstash_internal
xpack.management.elasticsearch.password: filebeat
xpack.management.logstash.poll_interval: 5s
pipeline.conf
{
"pipeline": "{
input {
beats {
host => "0.0.0.0"
port => 5044
ssl => false
client_inactivity_timeout => 1200
user => logstash_internal
password => filebeat
}
}
#filter {
#
#}
output {
elasticsearch {
hosts => \"elasticsearch:9200\"
user => logstash_internal,
password => filebeat,
manage_template => false
index => \"%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}\"
document_type => \"%{[@metadata][type]}\"
}
}
}"
}
Also, created a user with another thread on Logstash security since I'm using XPack: ls-security
Tried to restart containers and systemd service, also checked they were using the right config file.
Appreciate all the help