Filebeat -> Logstash Connection ISSUE

Elastic Stack Logstash
1

My ELK is in a server of xyzcorp.com of IP 16.xxx.xxx.xxx and filebeat is in xyz.com of IP 16.aaa.aaa.aaa

Both are in different domains but in same intranet umbrella.

In filebeat.yml, I'm enabling the output.logstash

- type: log
  enabled: true

  paths:
    - /path/to/*.log

output.logstash:
      # The Logstash hosts
      hosts: ["16.xxx.xxx.xxx:5044"]

and in logstash.config,

input {
        beats {
                type => beats
                port => 5044
                host => "16.xxx.xxx.xxx"
        }
}

and logstash.yml is unchanged

What is going wrong? I dont know!
Giving the following error:

  2019-07-12T06:57:20.928Z        ERROR   pipeline/output.go:100  Failed to connect to backoff(async(tcp://16.xxx.xxx.xxx:5044)): dial tcp 16.xxx.xxx.xxx:5044: i/o timeout
  2019-07-12T06:57:20.929Z        INFO    pipeline/output.go:93   Attempting to reconnect to backoff(async(tcp://16.xxx.xxx.xxx:5044)) with 2 reconnect attempt(s)
2

Hi @Sundaramoorthy_Anand,

Please check the below following points:
Are you able to do telnet or ping the host??
Are the port open or any rule??

Regards,
Harsh Bajaj

3

Yes ping is working and telnet to port 22/23/5044 is giving connection timed out error.

Where to see those port rules? Firewalld service is NOT running in the servers, actually.

4

Hi @Sundaramoorthy_Anand,

Its look like there is some blockage on port. However you said that firewalld is not running.

5

Changing it to a different port will give any improvement?

6

Could you please share the telnet command which you are running on your machine.

Actually, we need find the problem first and i don't think so changing port will give any result.

Regards,
Harsh Bajaj

7 
telnet <ip> 5044
Trying <ip>...
telnet: connect to address <ip>: Connection timed out

I also tried with other ports like 22 and 23 results in same ERROR

8

Hi @Sundaramoorthy_Anand,

There may be some problem or blockage with your firewall setting.

Regards,
Harsh Bajaj

9

Any comments on Filebeat and Logstash on different domains but on same data center umbrella?