# Filebeat not able to send logs to logstash (Filebeat fails to connect logstash)
**URL:** https://discuss.elastic.co/t/filebeat-not-able-to-send-logs-to-logstash-filebeat-fails-to-connect-logstash/164821
**Category:** Beats
**Tags:** filebeat
**Created:** [January 18, 2019, 3:33pm UTC](https://discuss.elastic.co/t/filebeat-not-able-to-send-logs-to-logstash-filebeat-fails-to-connect-logstash/164821 "2019-01-18T15:33:32Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@Vinit\_Kumar](https://discuss.elastic.co/u/Vinit_Kumar)
#### Post date: [January 18, 2019, 3:33pm UTC](https://discuss.elastic.co/t/filebeat-not-able-to-send-logs-to-logstash-filebeat-fails-to-connect-logstash/164821/1 "2019-01-18T15:33:32Z")
I'm using two servers on the cloud on one server (A) I installed filebeat and on second server (B) I have installed logstash, elasticsearch, and kibana. So I'm facing problem while sending logs from server A to server B on logstash.
My filebeat configuration is
```
filebeat.inputs:
- type: log
enabled: true
paths:
- /home/vinit/demo/*.log
fields:
log_type: apache
fields_under_root: true
#output.elasticsearch:
#hosts: ["localhost:9200"]
#protocol: "https"
#username: "elastic"
#password: "changeme"
output.logstash:
hosts: ["XXX.XX.X.XXX:5044"]
#ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]
#ssl.certificate: "/etc/pki/client/cert.pem"
#ssl.key: "/etc/pki/client/cert.key"
```
In logstash, I have enabled modules system, filebeat, and logstash.
Logstash configuration is
```
input {
beats {
port => 5044
}
}
filter {
grok {
match => { "message" => "^%{IP:CLIENT_IP} (?:-|%{USER:IDEN}) (?:-|%{USER:AUTH}) \[%{HTTPDATE:CREATED_ON}\] \"(?:%{WORD:REQUEST_METHOD} (?:/|%{NOTSPACE:REQUEST})(?: HTT$
add_field => {
"LOG_TYPES" => "apache-log"
}
overwrite => ["message"]
}
}
output {
elasticsearch {
hosts => ["localhost:9200"]
manage_template => false
index => "apache-info-log"
}
stdout { codec => rubydebug }
}
```
In Elasticsearch I did
. . .
network.host: localhost
. . .
I'm getting error are below-
```
|2019-01-18T15:05:47.738Z|INFO|crawler/crawler.go:72|Loading Inputs: 1|
|---|---|---|---|
|2019-01-18T15:05:47.739Z|INFO|log/input.go:138|Configured paths: [/home/vinit/demo/*.log]|
|2019-01-18T15:05:47.739Z|INFO|input/input.go:114|Starting input of type: log; ID: 10340820847180584185 |
|2019-01-18T15:05:47.740Z|INFO|log/input.go:138|Configured paths: [/var/log/logstash/logstash-plain*.log]|
|2019-01-18T15:05:47.740Z|INFO|log/input.go:138|Configured paths: [/var/log/logstash/logstash-slowlog-plain*.log]|
|2019-01-18T15:05:47.742Z|INFO|log/harvester.go:254|Harvester started for file: /home/vinit/demo/info-log.log|
|2019-01-18T15:05:47.749Z|INFO|log/input.go:138|Configured paths: [/var/log/auth.log* /var/log/secure*]|
|2019-01-18T15:05:47.763Z|INFO|log/input.go:138|Configured paths: [/var/log/messages* /var/log/syslog*]|
|2019-01-18T15:05:47.763Z|INFO|crawler/crawler.go:106|Loading and starting Inputs completed. Enabled inputs: 1|
|2019-01-18T15:05:47.763Z|INFO|cfgfile/reload.go:150|Config reloader started|
|2019-01-18T15:05:47.777Z|INFO|log/input.go:138|Configured paths: [/var/log/auth.log* /var/log/secure*]|
|2019-01-18T15:05:47.790Z|INFO|log/input.go:138|Configured paths: [/var/log/messages* /var/log/syslog*]|
|2019-01-18T15:05:47.790Z|INFO|input/input.go:114|Starting input of type: log; ID: 15514736912311113705 |
|2019-01-18T15:05:47.790Z|INFO|input/input.go:114|Starting input of type: log; ID: 4004097261679848995 |
|2019-01-18T15:05:47.791Z|INFO|log/input.go:138|Configured paths: [/var/log/logstash/logstash-plain*.log]|
|2019-01-18T15:05:47.791Z|INFO|log/input.go:138|Configured paths: [/var/log/logstash/logstash-slowlog-plain*.log]|
|2019-01-18T15:05:47.791Z|INFO|input/input.go:114|Starting input of type: log; ID: 2251543969305657601 |
|2019-01-18T15:05:47.791Z|INFO|input/input.go:114|Starting input of type: log; ID: 9013300092125558684 |
|2019-01-18T15:05:47.791Z|INFO|cfgfile/reload.go:205|Loading of config files completed.|
|2019-01-18T15:05:47.792Z|INFO|log/harvester.go:254|Harvester started for file: /var/log/secure-20181223|
|2019-01-18T15:05:47.794Z|INFO|log/harvester.go:254|Harvester started for file: /var/log/messages-20181223|
|2019-01-18T15:05:47.797Z|INFO|log/harvester.go:254|Harvester started for file: /var/log/secure-20181230|
|2019-01-18T15:05:47.800Z|INFO|log/harvester.go:254|Harvester started for file: /var/log/messages-20181230|
|2019-01-18T15:05:47.804Z|INFO|log/harvester.go:254|Harvester started for file: /var/log/secure-20190106|
|2019-01-18T15:05:47.804Z|INFO|log/harvester.go:254|Harvester started for file: /var/log/secure|
|2019-01-18T15:05:47.804Z|INFO|log/harvester.go:254|Harvester started for file: /var/log/secure-20190113|
|2019-01-18T15:05:47.816Z|INFO|log/harvester.go:254|Harvester started for file: /var/log/messages-20190106|
|2019-01-18T15:05:47.817Z|INFO|log/harvester.go:254|Harvester started for file: /var/log/messages|
|2019-01-18T15:05:47.818Z|INFO|log/harvester.go:254|Harvester started for file: /var/log/messages-20190113|
|2019-01-18T15:05:47.855Z|INFO|pipeline/output.go:95|Connecting to backoff(async(tcp://XXX.XX.X.XXX:5044))|
|2019-01-18T15:06:18.855Z|ERROR|pipeline/output.go:100|Failed to connect to backoff(async(tcp://XXX.XX.X.XXX:5044)): dial tcp XXX.XX.X.XXX:5044: i/o timeout|
|---|---|---|---|
|2019-01-18T15:06:18.855Z|INFO|pipeline/output.go:93|Attempting to reconnect to backoff(async(tcp://XXX.XX.X.XXX:5044)) with 1 reconnect attempt(s)|
```
Is anyone have any idea how to resolve this and make it work?
---
### Author:  [@shaunak](https://discuss.elastic.co/u/shaunak)
#### Post date: [January 18, 2019, 8:13pm UTC](https://discuss.elastic.co/t/filebeat-not-able-to-send-logs-to-logstash-filebeat-fails-to-connect-logstash/164821/2 "2019-01-18T20:13:48Z")
From server A are you able to reach XXX.XX.X.XXX:5044? Maybe try running `telnet XXX.XX.X.XXX 5044` on server A and see what happens?
---
### Author:  [@Vinit\_Kumar](https://discuss.elastic.co/u/Vinit_Kumar)
#### Post date: [January 18, 2019, 8:22pm UTC](https://discuss.elastic.co/t/filebeat-not-able-to-send-logs-to-logstash-filebeat-fails-to-connect-logstash/164821/3 "2019-01-18T20:22:53Z")
@shaunak thanks for reply... When I'm executing telnet with ip and port so it's saying command telnet not found.
And nginx installed in server B for authorization login.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 15, 2019, 8:23pm UTC](https://discuss.elastic.co/t/filebeat-not-able-to-send-logs-to-logstash-filebeat-fails-to-connect-logstash/164821/4 "2019-02-15T20:23:00Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.