Filebeat can't talk to logstash with connection refused error

(CaoPing) #1

I installed & configured filebeat in host A, logstash in host B. I hope filebeat sending log data to logstash in host B. However, after starting filebeat and logstash, error at filebeat side occurred. Below is the error info:

2016-07-26T10:42:46+08:00 INFO Start sending events to output
2016-07-26T10:42:46+08:00 INFO Connecting error publishing events (retrying): dial tcp getsockopt: connection refused

No error in logstash side.
I found some people posted the same problem in stackoverflow, but nobody answered it. Anyone here know why it happened and how to solve it? Thanks a lot!

By the way, version of filebeat is 1.2.3. version of logstash is 2.1.1

below is part of filebeat configuration, no TLS enabled:


Part of logstash configuration:

input {
beats {
hosts => ""
port => 5044

(Mark Walkom) #2

Would be why, you aren't listening on

Dial tcp (ip number):5044: getsockopt: connection refused
(CaoPing) #3

my understanding is that, it's configuration of logstash, which is in Filebeat sends log data to, so logstash should listen to localhost at port 5044. Not correct?

(ruflin) #4

To get started I would recommend not to specify the host at all. Please follow the getting started guide:

(CaoPing) #5

Hi Ruflin

Thank you so much. :smile: It works and filebeat can talk to logstash now after removing the host line. Thank you again.

(Andrew Kroh) #6