Filebeat -> Logstash Connection ISSUE

Elastic Stack Logstash
1

My ELK is in a server of xyzcorp.com of IP 16.xxx.xxx.xxx and filebeat is in xyz.com of IP 16.aaa.aaa.aaa

Both are in different domains but in same intranet umbrella.

In filebeat.yml, I'm enabling the output.logstash

- type: log
  enabled: true

  paths:
    - /path/to/*.log

output.logstash:
      # The Logstash hosts
      hosts: ["16.xxx.xxx.xxx:5044"]

and in logstash.config,

input {
        beats {
                type => beats
                port => 5044
                host => "16.xxx.xxx.xxx"
        }
}

and logstash.yml is unchanged

What is going wrong? I dont know!
Giving the following error:

  2019-07-12T06:57:20.928Z        ERROR   pipeline/output.go:100  Failed to connect to backoff(async(tcp://16.xxx.xxx.xxx:5044)): dial tcp 16.xxx.xxx.xxx:5044: i/o timeout
  2019-07-12T06:57:20.929Z        INFO    pipeline/output.go:93   Attempting to reconnect to backoff(async(tcp://16.xxx.xxx.xxx:5044)) with 2 reconnect attempt(s)
2

Hi @Sundaramoorthy_Anand,

Please check the below following points:
Are you able to do telnet or ping the host??
Are the port open or any rule??

Regards,
Harsh Bajaj

3

Yes ping is working and telnet to port 22/23/5044 is giving connection timed out error.

Where to see those port rules? Firewalld service is NOT running in the servers, actually.

4

Hi @Sundaramoorthy_Anand,

Its look like there is some blockage on port. However you said that firewalld is not running.

5

Changing it to a different port will give any improvement?

6

Could you please share the telnet command which you are running on your machine.

Actually, we need find the problem first and i don't think so changing port will give any result.

Regards,
Harsh Bajaj

7 
telnet <ip> 5044
Trying <ip>...
telnet: connect to address <ip>: Connection timed out

I also tried with other ports like 22 and 23 results in same ERROR

8

Hi @Sundaramoorthy_Anand,

There may be some problem or blockage with your firewall setting.

Regards,
Harsh Bajaj

9

Any comments on Filebeat and Logstash on different domains but on same data center umbrella?

10

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.