# Filebeat connection to ELK via port 5044 **URL:** \ **Category:** Logstash\ **Created:** [March 16, 2017, 1:13am UTC](https://discuss.elastic.co/t/filebeat-connection-to-elk-via-port-5044/78781 "2017-03-16T01:13:46Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![pleegor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pleegor/32/16389_2.png) [@pleegor](https://discuss.elastic.co/u/pleegor)\ **Post date:** [March 16, 2017, 1:13am UTC](https://discuss.elastic.co/t/filebeat-connection-to-elk-via-port-5044/78781/1 "2017-03-16T01:13:46Z")
Hi, I am trying to setup a filebeat shipping logs to ELK instance. 2017/03/16 01:07:45.254081 output.go:109: DBG output worker: publish 2046 events 2017/03/16 01:07:45.254086 sync.go:53: DBG connect 2017/03/16 01:07:45.135722 spooler.go:119: DBG Flushing spooler because spooler full. Events flushed: 2048 2017/03/16 01:07:45.133739 log\_file.go:84: DBG End of file reached: /var/log/secure; Backoff now. 2017/03/16 01:07:45.263672 single.go:140: ERR Connecting error publishing events (retrying): dial tcp 192.168.0.10:5044: getsockopt: connection refused 2017/03/16 01:07:45.263687 single.go:156: DBG send fail 2017/03/16 01:07:45.265035 log\_file.go:84: DBG End of file reached: /var/log/messages; Backoff now. 2017/03/16 01:07:46.255865 log\_file.go:84: DBG End of file reached: /var/log/secure; Backoff now. 2017/03/16 01:07:46.264054 sync.go:53: DBG connect 2017/03/16 01:07:46.264733 single.go:140: ERR Connecting error publishing events (retrying): dial tcp 192.168.0.10:5044: getsockopt: connection refused 2017/03/16 01:07:46.264750 single.go:156: DBG send fail 2017/03/16 01:07:46.265225 log\_file.go:84: DBG End of file reached: /var/log/messages; Backoff now. 2017/03/16 01:07:48.256628 log\_file.go:84: DBG End of file reached: /var/log/secure; Backoff now. 2017/03/16 01:07:48.265269 sync.go:53: DBG connect 2017/03/16 01:07:48.265557 log\_file.go:84: DBG End of file reached: /var/log/messages; Backoff now. 2017/03/16 01:07:48.265847 single.go:140: ERR Connecting error publishing events (retrying): dial tcp 192.168.0.10:5044: getsockopt: connection refused 2017/03/16 01:07:48.265858 single.go:156: DBG send fail 2017/03/16 01:07:50.255789 spooler.go:89: DBG Flushing spooler because of timeout. Events flushed: 1429 2017/03/16 01:07:52.257377 log\_file.go:84: DBG End of file reached: /var/log/secure; Backoff now. 2017/03/16 01:07:52.266088 sync.go:53: DBG connect 2017/03/16 01:07:52.266441 log\_file.go:84: DBG End of file reached: /var/log/messages; Backoff now. 2017/03/16 01:07:52.266784 single.go:140: ERR Connecting error publishing events (retrying): dial tcp 192.168.0.10:5044: getsockopt: connection refused When I ran telnet on ELK instance, I am seeing that port 5044 is not running. netstat -plnt Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 0.0.0.0:22 0.0.0.0:\* LISTEN 1082/sshd tcp 0 0 127.0.0.1:25 0.0.0.0:\* LISTEN 1916/master tcp 0 0 0.0.0.0:5601 0.0.0.0:\* LISTEN 652/node tcp6 0 0 127.0.0.1:9200 :::\* LISTEN 1097/java tcp6 0 0 ::1:9200 :::\* LISTEN 1097/java tcp6 0 0 127.0.0.1:9300 :::\* LISTEN 1097/java tcp6 0 0 ::1:9300 :::\* LISTEN 1097/java tcp6 0 0 :::22 :::\* LISTEN 1082/sshd tcp6 0 0 ::1:25 :::\* LISTEN 1916/master Logstash's config does specify port 5044 ``` input { beats { port => 5044 type => "JSON" ssl => true ssl_certificate => "/etc/pki/tls/certs/logstash-forwarder.crt" ssl_key => "/etc/pki/tls/private/logstash-forwarder.key" congestion_thershold => 1000 } } ``` Firewall is of as well. Any idea how to troubleshoot this? ---
**Author:** ![whyapenny](https://avatars.discourse-cdn.com/v4/letter/w/90db22/32.png) [@whyapenny](https://discuss.elastic.co/u/whyapenny)\ **Post date:** [March 16, 2017, 2:12am UTC](https://discuss.elastic.co/t/filebeat-connection-to-elk-via-port-5044/78781/2 "2017-03-16T02:12:28Z")
you might try first by simplifying. remove the ssl settings and congestion threshold, maybe even the type. start with something like: input{ beats{ port =\> 5044 } } then run a netstat to see if you see port 5044 running: netstat -an | grep 5044 if it is running, attempt to telnet from another server: telnet logstashHostname 5044 if that is successful, then you can start adding back settings until you find which is causing the issue and go from there. If that isn't successful, then you have to figure out why the application can't bind to the interface on that port. ---
**Author:** ![pleegor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pleegor/32/16389_2.png) [@pleegor](https://discuss.elastic.co/u/pleegor)\ **Post date:** [March 16, 2017, 2:58am UTC](https://discuss.elastic.co/t/filebeat-connection-to-elk-via-port-5044/78781/3 "2017-03-16T02:58:49Z")
After removing everything per your suggestion; things started working (I am seeing new logs). Anything specific I need to add when I use certs? ---
**Author:** ![whyapenny](https://avatars.discourse-cdn.com/v4/letter/w/90db22/32.png) [@whyapenny](https://discuss.elastic.co/u/whyapenny)\ **Post date:** [March 16, 2017, 3:06am UTC](https://discuss.elastic.co/t/filebeat-connection-to-elk-via-port-5044/78781/4 "2017-03-16T03:06:49Z")
i have never set it up over ssl, however by pure guess at your configs, you may be missing the password to the key? ---
**Author:** ![pleegor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pleegor/32/16389_2.png) [@pleegor](https://discuss.elastic.co/u/pleegor)\ **Post date:** [March 16, 2017, 3:12am UTC](https://discuss.elastic.co/t/filebeat-connection-to-elk-via-port-5044/78781/5 "2017-03-16T03:12:08Z")
I am not sure, there was a need for one... Per documents, I needed to copy cert onto client. Am I correct? As soon as bring back input { beats { port =\> 5044 type =\> "JSON" ssl =\> true ssl\_certificate =\> "/etc/pki/tls/certs/logstash-forwarder.crt" ssl\_key =\> "/etc/pki/tls/private/logstash-forwarder.key" congestion\_thershold =\> 1000 } } ---
**Author:** ![whyapenny](https://avatars.discourse-cdn.com/v4/letter/w/90db22/32.png) [@whyapenny](https://discuss.elastic.co/u/whyapenny)\ **Post date:** [March 16, 2017, 3:42am UTC](https://discuss.elastic.co/t/filebeat-connection-to-elk-via-port-5044/78781/6 "2017-03-16T03:42:07Z")
when you created your key, did you secure it with a password? if not, then you might be ok, and in that case i can no longer help. If your ssl\_key is indeed secured with a password, then that is most likely your issue. Perhaps there is a way to increase the log level in logstash log4j properties to get a better idea of what the issue is. Im fairly certain you will see some openssl errors, hopefully those will help you find the root issue. edit: at this point you may want to create a new post specifying you need help with ssl certs in logstash. you might catch the eye of some users with more experience there. ---
**Author:** ![pleegor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pleegor/32/16389_2.png) [@pleegor](https://discuss.elastic.co/u/pleegor)\ **Post date:** [March 16, 2017, 3:48am UTC](https://discuss.elastic.co/t/filebeat-connection-to-elk-via-port-5044/78781/7 "2017-03-16T03:48:06Z")
My key was not created with password. I will work on increasing log level. Thanks for your help! ---
**Author:** ![whyapenny](https://avatars.discourse-cdn.com/v4/letter/w/90db22/32.png) [@whyapenny](https://discuss.elastic.co/u/whyapenny)\ **Post date:** [March 16, 2017, 3:51am UTC](https://discuss.elastic.co/t/filebeat-connection-to-elk-via-port-5044/78781/8 "2017-03-16T03:51:35Z")
> [@whyapenny](#): > > at this point you may want to create a new post specifying you need help with ssl certs in logstash. you might catch the eye of some users with more experience there. just out of curiosity, is openssl installed on the logstash server? ---
**Author:** ![pleegor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pleegor/32/16389_2.png) [@pleegor](https://discuss.elastic.co/u/pleegor)\ **Post date:** [March 16, 2017, 3:56am UTC](https://discuss.elastic.co/t/filebeat-connection-to-elk-via-port-5044/78781/9 "2017-03-16T03:56:26Z")
> [@whyapenny](#): > > at this point you may want to create a new post specifying you need help with ssl certs in logstash. you might catch the eye of some users with more exper Yes, it is installed. I was able to generate cert on that server ---
**Author:** ![whyapenny](https://avatars.discourse-cdn.com/v4/letter/w/90db22/32.png) [@whyapenny](https://discuss.elastic.co/u/whyapenny)\ **Post date:** [March 16, 2017, 4:07am UTC](https://discuss.elastic.co/t/filebeat-connection-to-elk-via-port-5044/78781/10 "2017-03-16T04:07:46Z")
ok, one more thought, is congestion\_threshold a valid option for beats input? it isn't listed on the plugin page. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 13, 2017, 4:08am UTC](https://discuss.elastic.co/t/filebeat-connection-to-elk-via-port-5044/78781/11 "2017-04-13T04:08:14Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.