Filebeat: DNS lookup error for ip

Hi there,

I'm setting up filebeat on one of our servers. Config checks says everything is fine:

sudo service filebeat start
2017/04/06 12:28:36.166996 beat.go:285: INFO Home path: [/usr/share/filebeat] Config path: [/etc/filebeat] Data path: [/var/lib/filebeat] Logs path: [/var/log/filebeat]
2017/04/06 12:28:36.167072 beat.go:186: INFO Setup Beat: filebeat; Version: 5.3.0
2017/04/06 12:28:36.167194 logstash.go:90: INFO Max Retries set to: 3
2017/04/06 12:28:36.167218 metrics.go:23: INFO Metrics logging every 30s
2017/04/06 12:28:36.167373 outputs.go:108: INFO Activated logstash as output plugin.
2017/04/06 12:28:36.167523 publish.go:295: INFO Publisher name:
2017/04/06 12:28:36.167820 async.go:63: INFO Flush Interval set to: 1s
2017/04/06 12:28:36.167856 async.go:64: INFO Max Bulk Size set to: 2048
Config OK

But the log is flodded with errors

2017-04-06T14:31:39+02:00 WARN DNS lookup failure "http://IMAGINE_SOME_IP_ADDRESS_HERE:5044": lookup http://IMAGINE_SOME_IP_ADDRESS_HERE:5044: invalid domain name
2017-04-06T14:31:39+02:00 ERR Connecting error publishing events (retrying): lookup http://IMAGINE_SOME_IP_ADDRESS_HERE: invalid domain name

I can access the IP using telnet IMAGINE_SOME_IP_ADDRESS_HERE 5044

Why is an DNS lookup done?

My filebeat.yml:

    - input_type: log
        - /data/log/*.log

      - http://IMAGINE_SOME_IP_ADDRESS_HERE:5044
    index: testindex

Thank you in advance for any help! :slight_smile:


You know the feeling when you look "for hours" for the error, then you post somewhere for help and right after clicking "submit" you know what's causing the error? Well, here we go:


(strip the http://)


Remove the "http://" from the host. It doesn't communicate via HTTP to Logstash.

(edit: oh, I see you figured it out)

This topic was automatically closed after 21 days. New replies are no longer allowed.