# Filebeat: DNS lookup error for ip

**URL:** <https://discuss.elastic.co/t/filebeat-dns-lookup-error-for-ip/81466>\
**Category:** Beats\
**Created:** [April 6, 2017, 12:42pm UTC](https://discuss.elastic.co/t/filebeat-dns-lookup-error-for-ip/81466 "2017-04-06T12:42:18Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![mw\_jko](https://avatars.discourse-cdn.com/v4/letter/m/db5fbb/32.png) [@mw\_jko](https://discuss.elastic.co/u/mw_jko)\
**Post date:** [April 6, 2017, 12:42pm UTC](https://discuss.elastic.co/t/filebeat-dns-lookup-error-for-ip/81466/1 "2017-04-06T12:42:18Z")

</div>

Hi there,

I'm setting up filebeat on one of our servers. Config checks says everything is fine:

```
sudo service filebeat start
2017/04/06 12:28:36.166996 beat.go:285: INFO Home path: [/usr/share/filebeat] Config path: [/etc/filebeat] Data path: [/var/lib/filebeat] Logs path: [/var/log/filebeat]
2017/04/06 12:28:36.167072 beat.go:186: INFO Setup Beat: filebeat; Version: 5.3.0
2017/04/06 12:28:36.167194 logstash.go:90: INFO Max Retries set to: 3
2017/04/06 12:28:36.167218 metrics.go:23: INFO Metrics logging every 30s
2017/04/06 12:28:36.167373 outputs.go:108: INFO Activated logstash as output plugin.
2017/04/06 12:28:36.167523 publish.go:295: INFO Publisher name: node10.dev.sendnode.com
2017/04/06 12:28:36.167820 async.go:63: INFO Flush Interval set to: 1s
2017/04/06 12:28:36.167856 async.go:64: INFO Max Bulk Size set to: 2048
Config OK

```

But the log is flodded with errors

```
2017-04-06T14:31:39+02:00 WARN DNS lookup failure "http://IMAGINE_SOME_IP_ADDRESS_HERE:5044": lookup http://IMAGINE_SOME_IP_ADDRESS_HERE:5044: invalid domain name
2017-04-06T14:31:39+02:00 ERR Connecting error publishing events (retrying): lookup http://IMAGINE_SOME_IP_ADDRESS_HERE: invalid domain name

```

I can access the IP using `telnet IMAGINE_SOME_IP_ADDRESS_HERE 5044`

Why is an DNS lookup done?

My filebeat.yml:

```
filebeat:
  prospectors:
    - input_type: log
      paths:
        - /data/log/*.log

output:
  logstash:
    hosts:
      - http://IMAGINE_SOME_IP_ADDRESS_HERE:5044
    index: testindex

```

Thank you in advance for any help! 🙂

Edit:

You know the feeling when you look "for hours" for the error, then you post somewhere for help and right after clicking "submit" you _know_ what's causing the error? Well, here we go:

```
 hosts:
   - IMAGINE_SOME_IP_ADDRESS_HERE:5044

```

(strip the http://)

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [April 6, 2017, 10:44pm UTC](https://discuss.elastic.co/t/filebeat-dns-lookup-error-for-ip/81466/2 "2017-04-06T22:44:12Z")

</div>

Remove the "http://" from the host. It doesn't communicate via HTTP to Logstash.

(edit: oh, I see you figured it out)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 27, 2017, 12:42pm UTC](https://discuss.elastic.co/t/filebeat-dns-lookup-error-for-ip/81466/3 "2017-04-27T12:42:18Z")

</div>

This topic was automatically closed after 21 days. New replies are no longer allowed.