Filebeat can't talk to logstash with connection refused error

Elastic Stack Beats
1

I installed & configured filebeat in host A, logstash in host B. I hope filebeat sending log data to logstash in host B. However, after starting filebeat and logstash, error at filebeat side occurred. Below is the error info:

2016-07-26T10:42:46+08:00 INFO Start sending events to output
2016-07-26T10:42:46+08:00 INFO Connecting error publishing events (retrying): dial tcp 9.112.224.129:5044: getsockopt: connection refused

No error in logstash side.
I found some people posted the same problem in stackoverflow, but nobody answered it. Anyone here know why it happened and how to solve it? Thanks a lot!

By the way, version of filebeat is 1.2.3. version of logstash is 2.1.1

below is part of filebeat configuration, no TLS enabled:

logstash:
hosts:["9.112.224.129:5044"]

Part of logstash configuration:

input {
beats {
hosts => "127.0.0.1"
port => 5044
}
}

2

Would be why, you aren't listening on 9.112.224.129.

3

my understanding is that, it's configuration of logstash, which is in 9.112.224.129. Filebeat sends log data to 9.112.224.129:5044, so logstash should listen to localhost at port 5044. Not correct?

4

To get started I would recommend not to specify the host at all. Please follow the getting started guide: https://www.elastic.co/guide/en/beats/libbeat/1.2/logstash-installation.html#logstash-setup

2 Likes
5

Hi Ruflin

Thank you so much. :smile: It works and filebeat can talk to logstash now after removing the host line. Thank you again.