FileBeat cant connect to Logstash

Elastic Stack Beats
1

Hello everyone, so i installed ELK on a server and filebeat on a client and it was working fine. now that im going to prod env i did the same thing but filebeat cant for some reason reach logstash.
Im using aws instances, any help or guides are greatly appreciated.

Thanks in advance!

2

@Ghaith_Haddad,

First of all please check that your logstash machine is reachable on port 5044 from machine where you installed filebeat.

You can check using below command:

telnet logstash_machine_ip 5044

If you are unable to telnet then you need to set firewall rule. If you are able to telnet then please provide some error log from filebeat.

Note:- If you are using some other port rather then 5044 please use that port.
Thanks.

3

Hello @Tek_Chand,

thank you for your reply, i cant telnet to the logstash machine even though the firewall rules are set properly, but it seems that logstash is listening on ipv6 instead of ipv4. Any idea why?

COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
java 14980 logstash 104u IPv6 135663 0t0 TCP *:5044 (LISTEN)

4

@Ghaith_Haddad,

At my end also logstash is listening on ipv6 and its working fine. ELK team also confirm same in below post:

logstash on ipv6

So it seems firewall rule or service issue. Please check the logstash log also is there any error?

Thanks.

5

While it should work with ipv6 you might look at this github thread (below) for reference. Did you also ensure that your firewall has the right ipv6 permissions in the allow rules? For instance 10.0.0.1 in ipv4 can be written 0:0:0:0:0:ffff:a00:1 in ipv6.

ipv4 to ipv6 conversion tool:

https://www.ultratools.com/tools/ipv4toipv6

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.