Filebeat connection error while publishing events to Logstash


#1

I set up Filebeat on Windows 10 and trying to ship logs from my local to Logstash.

Configuration in filebeat.yml file

paths:
#- /var/log/*.log
- C:\http_log*

#logstash:
# The Logstash hosts
hosts: ["localhost:5049"]

File Beat configuration in logstash.conf
input {
beats {
host => "localhost"
port => 5049
type => "log"
}
}

I verified the logstash is running on 5049 port but Filebeat is unable to connect to Logstash

2016/06/21 20:55:05.323731 output.go:87: DBG output worker: publish 50 events
2016/06/21 20:55:06.628690 single.go:126: INFO Connecting error publishing events (retrying): Head http://localhost:5049
: EOF
2016/06/21 20:55:06.628690 single.go:152: INFO send fail
2016/06/21 20:55:06.629693 single.go:159: INFO backoff retry: 1s
2016/06/21 20:55:08.727235 single.go:126: INFO Connecting error publishing events (retrying): Head http://localhost:5049
: EOF

I tried telnet to localhost 5059 and looks like I'm able to telnet but still the logs are not getting shipped to Logstash

command used
logstash-plugin install logstash-input-beats

io/console not supported; tty will not be manipulated
Validating logstash-input-beats
Unable to download data from https://rubygems.org - SocketError: initialize: name or service not known (https://rubygems.org/latest_specs.4.8.gz)
ERROR: Installation aborted, verification failed for logstash-input-beats

command used
logstash-plugin update logstash-input-beats
io/console not supported; tty will not be manipulated
ERROR: Updated Aborted, message: initialize: name or service not known

Please advise


(Andrew Kroh) #2

It looks like you have a configuration issue. It is trying to connect to Elasticsearch at http://localhost:5049.

Make sure you have fully commented out elasticsearch and uncommented logstash like so:

logstash:
  hosts: ['localhost:5049']

#3

It's working now .. Thank you for helping me


(Andrew Kroh) #4