Filebeat logstash output other than 5044 is not working

[gorkii (felix)]

Hello,

I have a problem that if filebeat output is configured to use any ports except 5044 is not working. Filebeat does not send ACK after receiving SYN, ACK from the logstash. When I change the port to 5044, it is working fine. Can anyone help me? My configuration is below.

#=========================== Filebeat inputs =============================
filebeat.inputs:

• enabled: true
  paths:
  - /apps/debug/aplog/debug.txt
  include_lines: ['CurrentAlarm']
  fields_under_root: true
  fields:
  monitortype: almcnt
  systype: mec
  sysgroup: mec

• enabled: false
  paths:
  - /apps/debug/oslog/messages
  fields_under_root: true
  fields:
  monitortype: oslog
  systype: mec
  sysgroup: mec

#----------------------------- Logstash output --------------------------------
output.logstash:
hosts: ["172.20.2.92:5055"]

Thank you in advance.

[steffens (Steffen Siering)]

You need to use a port Logstash is bound to. Logstash acts as server and Beats connect to it. If you want to use another port, then you need to configure logstash (and firewals?) to open said port.