# Filebeat cannot connect to Logstash \[Logstash/Filebeat 7.9.x\]

**URL:** <https://discuss.elastic.co/t/filebeat-cannot-connect-to-logstash-logstash-filebeat-7-9-x/254189>\
**Category:** Beats\
**Tags:** elastic-stack-security, docker, filebeat\
**Created:** [November 3, 2020, 10:36pm UTC](https://discuss.elastic.co/t/filebeat-cannot-connect-to-logstash-logstash-filebeat-7-9-x/254189 "2020-11-03T22:36:02Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![fraballi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fraballi/32/57127_2.png) [@fraballi](https://discuss.elastic.co/u/fraballi)\
**Post date:** [November 3, 2020, 10:36pm UTC](https://discuss.elastic.co/t/filebeat-cannot-connect-to-logstash-logstash-filebeat-7-9-x/254189/1 "2020-11-03T22:36:02Z")

</div>

Dear colleagues,

Version: **7.9.x**  
I have two instances of Filebeat (_ **docker** _, _ **rpm** _ in _localhost_), none can connect to Logstash (_ **docker** _).

I searched on similar topics and tried solutions, but still cannot reach safe port.

These are my settings:

**filebeat.yml**

```auto
filebeat.inputs:
  - type: log
    enabled: true
    paths:
      - /tmp/logs/*/*.log

# output.elasticsearch:
# index: filebeat
# hosts: ["elasticsearch:9200"]                    
# username: elastic
# password: changeme

output:
  logstash:
    enabled: true
    hosts: ["logstash:5044"]                       
    compression_level: 3
    ssl:
      enabled: false
    ttl: 30s
    backoff:
      init: 3s
setup:
  kibana:
    host: "kibana:5601"
    username: elastic
    password: changeme
  ilm:
    enabled: auto                             
    overwrite: true
    rollover_alias: "filebeat-%{[agent.version]}"
    pattern: "{now/d}-000001"
    policy_name: "my-policy"
  template:
    overwrite: true
    name: "filebeat-%{[agent.version]}"
    pattern: "filebeat-%{[agent.version]}-*"
    output:
      elasticsearch:
        username: elastic
        password: changeme

```

**logstash.yml**

```auto
---
## Default Logstash configuration from logstash-docker.
## from https://github.com/elastic/logstash-docker/blob/master/build/logstash/config/logstash-full.yml
#
http.host: "0.0.0.0"
#path.config: /usr/share/logstash/pipeline
monitoring.elasticsearch.hosts: http://elasticsearch:9200

## X-Pack security credentials
#
monitoring.elasticsearch.username: elastic
monitoring.elasticsearch.password: changeme # unset by default. see:
                                                   # https://www.elastic.co/guide/en/logstash/current/ls-security.html#ls-monitoring-user

## PIPELINE CONFIGURATION

xpack.management.enabled: true
xpack.management.elasticsearch.hosts: http://elasticsearch:9200
xpack.management.elasticsearch.username: logstash_internal
xpack.management.elasticsearch.password: filebeat
xpack.management.logstash.poll_interval: 5s

```

**pipeline.conf**

```auto
{
    "pipeline": "{
        input {
            beats {
                host => "0.0.0.0"
                port => 5044
                ssl => false
                client_inactivity_timeout => 1200
                user => logstash_internal
                password => filebeat
            }
        }

        #filter {
        #
        #}

        output {
            elasticsearch {
                hosts => \"elasticsearch:9200\"
                user => logstash_internal,
                password => filebeat,
                manage_template => false
                index => \"%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}\"
                document_type => \"%{[@metadata][type]}\"
            }
        }
    }"
}

```

Also, created a user with another thread on Logstash security since I'm using **XPack** : [ls-security](https://www.elastic.co/guide/en/logstash/current/ls-security.html)

Tried to restart containers and systemd service, also checked they were using the right config file.

Appreciate all the help 😉

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 2, 2020, 12:36am UTC](https://discuss.elastic.co/t/filebeat-cannot-connect-to-logstash-logstash-filebeat-7-9-x/254189/2 "2020-12-02T00:36:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.