# Filebeat - first setup **URL:** \ **Category:** Logstash\ **Created:** [November 6, 2016, 10:22pm UTC](https://discuss.elastic.co/t/filebeat-first-setup/65153 "2016-11-06T22:22:43Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![sliddjur](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sliddjur/32/65260_2.png) [@sliddjur](https://discuss.elastic.co/u/sliddjur)\ **Post date:** [November 6, 2016, 10:22pm UTC](https://discuss.elastic.co/t/filebeat-first-setup/65153/1 "2016-11-06T22:22:44Z")
Hello, Im trying to setup my first test site. ``` This is my filebeat.yml filebeat.prospectors: - input_type: log - /var/log/*.log - /var/log/auth.log output.logstash: # The Logstash hosts hosts: ["172.23.253.24:5043"] ``` * * * my logstash config: /etc/logstash/conf.d$ cat first.conf input { beats { port =\> "5043" } } output { elasticsearch { hosts =\> ["172.23.253.23:9200"] protocol =\> "http" } } * * * My /var/log/filebeat/filebeat logfile: ``` 2016-11-06T23:14:28+01:00 INFO Starting spooler: spool_size: 2048; idle_timeout: 5s 2016-11-06T23:14:28+01:00 INFO Start sending events to output 2016-11-06T23:14:33+01:00 ERR Connecting error publishing events (retrying): dial tcp 172.23.253.24:5043: getsockopt: connection refused 2016-11-06T23:14:34+01:00 ERR Connecting error publishing events (retrying): dial tcp 172.23.253.24:5043: getsockopt: connection refused 2016-11-06T23:14:36+01:00 ERR Connecting error publishing events (retrying): dial tcp 172.23.253.24:5043: getsockopt: connection refused 2016-11-06T23:14:40+01:00 ERR Connecting error publishing events (retrying): dial tcp 172.23.253.24:5043: getsockopt: connection refused 2016-11-06T23:14:48+01:00 ERR Connecting error publishing events (retrying): dial tcp 172.23.253.24:5043: getsockopt: connection refused 2016-11-06T23:14:58+01:00 INFO Non-zero metrics in the last 30s: filebeat.harvester.running=1 libbeat.publisher.published_events=10 filebeat.harvester.started=1 filebeat.harvester.open_files=1 2016-11-06T23:15:04+01:00 ERR Connecting error publishing events (retrying): dial tcp 172.23.253.24:5043: getsockopt: connection refused 2016-11-06T23:15:28+01:00 INFO No non-zero metrics in the last 30s 2016-11-06T23:15:36+01:00 ERR Connecting error publishing events (retrying): dial tcp 172.23.253.24:5043: getsockopt: connection refused 2016-11-06T23:15:58+01:00 INFO No non-zero metrics in the last 30s 2016-11-06T23:16:28+01:00 INFO No non-zero metrics in the last 30s 2016-11-06T23:16:36+01:00 ERR Connecting error publishing events (retrying): dial tcp 172.23.253.24:5043: getsockopt: connection refused 2016-11-06T23:16:58+01:00 INFO No non-zero metrics in the last 30s ``` * * * On logstash server I have also installed ./logstash-plugin install logstash-input-beats I am running ubuntu 16.04.1 logstash 5 filebeat 5 installed from repository ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [November 7, 2016, 6:38am UTC](https://discuss.elastic.co/t/filebeat-first-setup/65153/2 "2016-11-07T06:38:54Z")
It looks like Logstash on 172.23.253.24 isn't actually listening on port 5043 (check with netstat), or maybe the port is blocked by a firewall. ---
**Author:** ![sliddjur](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sliddjur/32/65260_2.png) [@sliddjur](https://discuss.elastic.co/u/sliddjur)\ **Post date:** [November 7, 2016, 7:19am UTC](https://discuss.elastic.co/t/filebeat-first-setup/65153/3 "2016-11-07T07:19:06Z")
yes I checked its open olof@80003v-app002:/etc/filebeat$ netcat -z -v 172.23.253.24 5043 Connection to 172.23.253.24 5043 port [tcp/\*] succeeded! ---
**Author:** ![sliddjur](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sliddjur/32/65260_2.png) [@sliddjur](https://discuss.elastic.co/u/sliddjur)\ **Post date:** [November 7, 2016, 9:28am UTC](https://discuss.elastic.co/t/filebeat-first-setup/65153/4 "2016-11-07T09:28:28Z")
Restarted both services. on logstash: ``` @80003v-app004:/etc/logstash/conf.d# netstat -ln | grep 5043 tcp6 0 0 :::5043 :::* LISTEN ``` filebeat logfile ``` 2016-11-07T10:20:29+01:00 INFO Starting prospector of type: log 2016-11-07T10:20:29+01:00 INFO Harvester started for file: /var/log/kern.log 2016-11-07T10:20:29+01:00 INFO Start sending events to output 2016-11-07T10:20:29+01:00 INFO Starting Registrar 2016-11-07T10:20:29+01:00 INFO Starting spooler: spool_size: 2048; idle_timeout: 5s 2016-11-07T10:20:29+01:00 INFO Harvester started for file: /var/log/vsftpd.log 2016-11-07T10:20:29+01:00 INFO Harvester started for file: /var/log/auth.log 2016-11-07T10:20:59+01:00 INFO Non-zero metrics in the last 30s: publish.events=43 registrar.writes=1 filebeat.harvester.running=3 libbeat.logstash.publish.read_bytes=18 libbeat.logstash.published_and_acked_events=32 libbeat.publisher.published_events=32 filebeat.harvester.started=3 filebeat.harvester.open_files=3 libbeat.logstash.publish.write_bytes=1882 registar.states.current=11 libbeat.logstash.call_count.PublishEvents=1 registrar.states.update=43 2016-11-07T10:20:59+01:00 ERR Failed to publish events caused by: EOF 2016-11-07T10:20:59+01:00 INFO Error publishing events (retrying): EOF 2016-11-07T10:21:29+01:00 INFO Non-zero metrics in the last 30s: registrar.states.update=22 libbeat.logstash.publish.read_bytes=24 libbeat.logstash.publish.read_errors=1 publish.events=22 libbeat.logstash.published_and_acked_events=22 libbeat.logstash.published_but_not_acked_events=11 libbeat.publisher.published_events=22 registrar.writes=4 libbeat.logstash.call_count.PublishEvents=5 libbeat.logstash.publish.write_bytes=2671 2016-11-07T10:21:59+01:00 INFO No non-zero metrics in the last 30s 2016-11-07T10:22:29+01:00 INFO No non-zero metrics in the last 30s 2016-11-07T10:22:59+01:00 INFO No non-zero metrics in the last 30s 2016-11-07T10:23:14+01:00 ERR Failed to publish events caused by: EOF 2016-11-07T10:23:14+01:00 INFO Error publishing events (retrying): EOF ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 5, 2016, 9:28am UTC](https://discuss.elastic.co/t/filebeat-first-setup/65153/5 "2016-12-05T09:28:28Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.