Filebeat cannot connect to Logstash [Logstash/Filebeat 7.9.x]

Dear colleagues,

Version: 7.9.x
I have two instances of Filebeat (docker, rpm in localhost), none can connect to Logstash (docker).

I searched on similar topics and tried solutions, but still cannot reach safe port.

These are my settings:

filebeat.yml

filebeat.inputs:
  - type: log
    enabled: true
    paths:
      - /tmp/logs/*/*.log

# output.elasticsearch:
#  index: filebeat
#  hosts: [ "elasticsearch:9200" ]                    
#  username: elastic
#  password: changeme

output:
  logstash:
    enabled: true
    hosts: [ "logstash:5044" ]                       
    compression_level: 3
    ssl:
      enabled: false
    ttl: 30s
    backoff:
      init: 3s
setup:
  kibana:
    host: "kibana:5601"
    username: elastic
    password: changeme
  ilm:
    enabled: auto                             
    overwrite: true
    rollover_alias: "filebeat-%{[agent.version]}"
    pattern: "{now/d}-000001"
    policy_name: "my-policy"
  template:
    overwrite: true
    name: "filebeat-%{[agent.version]}"
    pattern: "filebeat-%{[agent.version]}-*"
    output:
      elasticsearch:
        username: elastic
        password: changeme

logstash.yml

---
## Default Logstash configuration from logstash-docker.
## from https://github.com/elastic/logstash-docker/blob/master/build/logstash/config/logstash-full.yml
#
http.host: "0.0.0.0"
#path.config: /usr/share/logstash/pipeline
monitoring.elasticsearch.hosts: http://elasticsearch:9200

## X-Pack security credentials
#
monitoring.elasticsearch.username: elastic
monitoring.elasticsearch.password: changeme  # unset by default. see:
                                                   # https://www.elastic.co/guide/en/logstash/current/ls-security.html#ls-monitoring-user

## PIPELINE CONFIGURATION

xpack.management.enabled: true
xpack.management.elasticsearch.hosts: http://elasticsearch:9200
xpack.management.elasticsearch.username: logstash_internal
xpack.management.elasticsearch.password: filebeat
xpack.management.logstash.poll_interval: 5s

pipeline.conf

{
    "pipeline": "{
        input {
            beats {
                host => "0.0.0.0"
                port => 5044
                ssl => false
                client_inactivity_timeout => 1200
                user => logstash_internal
                password => filebeat
            }
        }

        #filter {
        #
        #}

        output {
            elasticsearch {
                hosts => \"elasticsearch:9200\"
                user => logstash_internal,
                password => filebeat,
                manage_template => false
                index => \"%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}\"
                document_type => \"%{[@metadata][type]}\"
            }
        }
    }"
}

Also, created a user with another thread on Logstash security since I'm using XPack: ls-security

Tried to restart containers and systemd service, also checked they were using the right config file.

Appreciate all the help :wink:

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.