Filebeat logstash output other than 5044 is not working

Elastic Stack Beats
1

Hello,

I have a problem that if filebeat output is configured to use any ports except 5044 is not working. Filebeat does not send ACK after receiving SYN, ACK from the logstash. When I change the port to 5044, it is working fine. Can anyone help me? My configuration is below.

#=========================== Filebeat inputs =============================
filebeat.inputs:

  • enabled: true
    paths:
    - /apps/debug/aplog/debug.txt
    include_lines: ['CurrentAlarm']
    fields_under_root: true
    fields:
    monitortype: almcnt
    systype: mec
    sysgroup: mec

  • enabled: false
    paths:
    - /apps/debug/oslog/messages
    fields_under_root: true
    fields:
    monitortype: oslog
    systype: mec
    sysgroup: mec

#----------------------------- Logstash output --------------------------------
output.logstash:
hosts: ["172.20.2.92:5055"]

Thank you in advance.

2

You need to use a port Logstash is bound to. Logstash acts as server and Beats connect to it. If you want to use another port, then you need to configure logstash (and firewals?) to open said port.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.