# Filebeat captured log data not making it to LogStash (Errors resulting)

**URL:** <https://discuss.elastic.co/t/filebeat-captured-log-data-not-making-it-to-logstash-errors-resulting/72914>\
**Category:** Beats\
**Created:** [January 26, 2017, 3:18pm UTC](https://discuss.elastic.co/t/filebeat-captured-log-data-not-making-it-to-logstash-errors-resulting/72914 "2017-01-26T15:18:27Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![CodingRiot](https://avatars.discourse-cdn.com/v4/letter/c/7feea3/32.png) [@CodingRiot](https://discuss.elastic.co/u/CodingRiot)\
**Post date:** [January 26, 2017, 3:18pm UTC](https://discuss.elastic.co/t/filebeat-captured-log-data-not-making-it-to-logstash-errors-resulting/72914/1 "2017-01-26T15:18:27Z")

</div>

I have setup a new ELK stack using Elasticsearch, Kibana, LogStash, and Filebeat, however the files that should be picked up from the Filebeat service and transferred over to LogStash are not currently making it there for some reason, so when I go to check elasticsearch to see if the data made it through (using http endpoint at: [http://elasticsearchsvr:9200/filebeath-\*/\_serach](http://elasticsearchsvr:9200/filebeath-*/_serach)) it returns hits total = 0. I can't seem to figure out what is wrong.  
Any help/advice is appreciated.

**Note** : The stack setup is currently setup as:  
Elasticserach, Kibana, and LogStash on 1 server (running Linux Ubuntu Server 14.04)  
Filebeat on another server (running Windows OS)

I have the Filebeat service to log in Debug, please see the following errors I am receiving.

[_ **Filebeat Errors in log** _]  
2017-01-26T09:03:31-06:00 DBG output worker: publish 50 events  
2017-01-26T09:03:31-06:00 DBG connect  
2017-01-26T09:03:31-06:00 DBG Try to publish 50 events to logstash with window size 10  
2017-01-26T09:03:31-06:00 DBG handle error: EOF  
2017-01-26T09:03:31-06:00 DBG closing  
2017-01-26T09:03:31-06:00 DBG 0 events out of 50 events sent to logstash. Continue sending  
2017-01-26T09:03:31-06:00 DBG close connection  
2017-01-26T09:03:31-06:00 ERR Failed to publish events caused by: EOF  
2017-01-26T09:03:31-06:00 INFO Error publishing events (retrying): EOF  
2017-01-26T09:03:31-06:00 DBG close connection  
2017-01-26T09:03:31-06:00 DBG send fail  
2017-01-26T09:03:32-06:00 DBG connect

[_ **LogStash Log errors** _]  
{:message=\>"Connection refused (Connection refused)", :class=\>"Manticore::SocketException", .... :level=\>:error}

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [January 27, 2017, 12:42am UTC](https://discuss.elastic.co/t/filebeat-captured-log-data-not-making-it-to-logstash-errors-resulting/72914/2 "2017-01-27T00:42:07Z")

</div>

so, logstash is refusing the connection?

Can you share configs?

Have you tried telnet from windows host to logstash?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 16, 2017, 3:19pm UTC](https://discuss.elastic.co/t/filebeat-captured-log-data-not-making-it-to-logstash-errors-resulting/72914/3 "2017-02-16T15:19:09Z")

</div>

This topic was automatically closed after 21 days. New replies are no longer allowed.