# Filebeat not sending logs to logstash (Versions 5.4.1) **URL:** \ **Category:** Logstash\ **Created:** [June 14, 2017, 11:14am UTC](https://discuss.elastic.co/t/filebeat-not-sending-logs-to-logstash-versions-5-4-1/89366 "2017-06-14T11:14:18Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![James88](https://avatars.discourse-cdn.com/v4/letter/j/bbce88/32.png) [@James88](https://discuss.elastic.co/u/James88)\ **Post date:** [June 14, 2017, 11:14am UTC](https://discuss.elastic.co/t/filebeat-not-sending-logs-to-logstash-versions-5-4-1/89366/1 "2017-06-14T11:14:18Z")
I have installed ELK version 5.4.1. Everything went well but for some reason, filebeat cannot send logs to logstash. 2017-06-14T13:59:57+03:00 INFO No non-zero metrics in the last 30s 2017-06-14T14:00:27+03:00 INFO No non-zero metrics in the last 30s 2017-06-14T14:00:46+03:00 ERR Connecting error publishing events (retrying): dial tcp [::1]:5044: getsockopt: connection refused 2017-06-14T14:00:57+03:00 INFO No non-zero metrics in the last 30s 2017-06-14T14:01:27+03:00 INFO No non-zero metrics in the last 30s 2017-06-14T14:01:46+03:00 ERR Connecting error publishing events (retrying): dial tcp [::1]:5044: getsockopt: connection refused 2017-06-14T14:01:57+03:00 INFO No non-zero metrics in the last 30s 2017-06-14T14:02:27+03:00 INFO No non-zero metrics in the last 30s 2017-06-14T14:02:46+03:00 ERR Connecting error publishing events (retrying): dial tcp [::1]:5044: getsockopt: connection refused 2017-06-14T14:02:57+03:00 INFO No non-zero metrics in the last 30s To add on that, Logstash is not listening on any port. I expected it to listen to port 5044 as configured in filebeat .yml file. output.logstash: # The Logstash hosts hosts: ["localhost:5044"] bulk\_max\_size: 2048 # Optional SSL. By default is off. # List of root certificates for HTTPS server verifications ssl.certificate\_authorities: ["/etc/pki/tls/certs/logstash-forwarder.crt"] # Certificate for SSL client authentication #ssl.certificate: "/etc/pki/client/cert.pem" # Client Certificate Key #ssl.key: "/etc/pki/client/cert.key" ---
**Author:** ![Leandro\_Sampaio](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandro_sampaio/32/18409_2.png) [@Leandro\_Sampaio](https://discuss.elastic.co/u/Leandro_Sampaio)\ **Post date:** [June 14, 2017, 11:34am UTC](https://discuss.elastic.co/t/filebeat-not-sending-logs-to-logstash-versions-5-4-1/89366/2 "2017-06-14T11:34:22Z")
One dought Did you start a logstash to listen on 5044? Can you put config here ?? ---
**Author:** ![James88](https://avatars.discourse-cdn.com/v4/letter/j/bbce88/32.png) [@James88](https://discuss.elastic.co/u/James88)\ **Post date:** [June 14, 2017, 11:55am UTC](https://discuss.elastic.co/t/filebeat-not-sending-logs-to-logstash-versions-5-4-1/89366/3 "2017-06-14T11:55:56Z")
Here is the log from /var/log/logstash/logstash-plain.log [2017-06-14T14:53:07,758][FATAL][logstash.runner] An unexpected error occurred! {:error=\>#\, :backtrace=\>["/usr/share/logstash/logstash-core/lib/logstash/settings.rb:433:in `validate'", "/usr/share/logstash/logstash-core/lib/logstash/settings.rb:216:in`validate\_value'", "/usr/share/logstash/logstash-core/lib/logstash/settings.rb:132:in `validate_all'", "org/jruby/RubyHash.java:1342:in`each'", "/usr/share/logstash/logstash-core/lib/logstash/settings.rb:131:in `validate_all'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:217:in`execute'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/clamp-0.6.5/lib/clamp/command.rb:67:in `run'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:185:in`run'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/clamp-0.6.5/lib/clamp/command.rb:132:in `run'", "/usr/share/logstash/lib/bootstrap/environment.rb:71:in`(root)'"]} [2017-06-14T14:53:37,542][FATAL][logstash.runner] An unexpected error occurred! {:error=\>#\, :backtrace=\>["/usr/share/logstash/logstash-core/lib/logstash/settings.rb:433:in `validate'", "/usr/share/logstash/logstash-core/lib/logstash/settings.rb:216:in`validate\_value'", "/usr/share/logstash/logstash-core/lib/logstash/settings.rb:132:in `validate_all'", "org/jruby/RubyHash.java:1342:in`each'", "/usr/share/logstash/logstash-core/lib/logstash/settings.rb:131:in `validate_all'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:217:in`execute'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/clamp-0.6.5/lib/clamp/command.rb:67:in `run'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:185:in`run'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/clamp-0.6.5/lib/clamp/command.rb:132:in `run'", "/usr/share/logstash/lib/bootstrap/environment.rb:71:in`(root)'"]} ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [June 14, 2017, 12:31pm UTC](https://discuss.elastic.co/t/filebeat-not-sending-logs-to-logstash-versions-5-4-1/89366/4 "2017-06-14T12:31:07Z")
As the error message indicates Logstash doesn't start up, but your log snippet is incomplete. In you look in your log, what comes after `:error=>#` on the first line? Please post your Logstash configuration as requested earlier. ---
**Author:** ![JayArthur](https://avatars.discourse-cdn.com/v4/letter/j/7feea3/32.png) [@JayArthur](https://discuss.elastic.co/u/JayArthur)\ **Post date:** [June 14, 2017, 1:21pm UTC](https://discuss.elastic.co/t/filebeat-not-sending-logs-to-logstash-versions-5-4-1/89366/7 "2017-06-14T13:21:54Z")
![](https://us1.discourse-cdn.com/elastic/original/3X/b/3/b306a39786e922cdf21cfb7ef356b4bb81bfaff3.PNG) ---
**Author:** ![JayArthur](https://avatars.discourse-cdn.com/v4/letter/j/7feea3/32.png) [@JayArthur](https://discuss.elastic.co/u/JayArthur)\ **Post date:** [June 14, 2017, 1:23pm UTC](https://discuss.elastic.co/t/filebeat-not-sending-logs-to-logstash-versions-5-4-1/89366/8 "2017-06-14T13:23:59Z")
@magnusbaeck check below.. I think its a permission issue.. I'm not quite sure . Any heads up ? ![](https://us1.discourse-cdn.com/elastic/original/3X/b/3/b306a39786e922cdf21cfb7ef356b4bb81bfaff3.PNG) ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [June 14, 2017, 1:28pm UTC](https://discuss.elastic.co/t/filebeat-not-sending-logs-to-logstash-versions-5-4-1/89366/9 "2017-06-14T13:28:28Z")
Jeez, copy/paste the text instead of posting screenshots. So is /var/lib/logstash/queue writable to the user running Logstash? ---
**Author:** ![James88](https://avatars.discourse-cdn.com/v4/letter/j/bbce88/32.png) [@James88](https://discuss.elastic.co/u/James88)\ **Post date:** [June 14, 2017, 1:36pm UTC](https://discuss.elastic.co/t/filebeat-not-sending-logs-to-logstash-versions-5-4-1/89366/10 "2017-06-14T13:36:07Z")
@magnusbaeck I took a screenshot because the text after :error=\> and before :backtrace=\> was getting ommited upon pasting in the editor... Anyhow, Yes /var/lib/logstash/queue is writeable only to the user , in this case, root. ---
**Author:** ![James88](https://avatars.discourse-cdn.com/v4/letter/j/bbce88/32.png) [@James88](https://discuss.elastic.co/u/James88)\ **Post date:** [June 15, 2017, 7:37am UTC](https://discuss.elastic.co/t/filebeat-not-sending-logs-to-logstash-versions-5-4-1/89366/11 "2017-06-15T07:37:55Z")
@magnusbaeck I finally resolved the issue. My ELK is now working and I can send logs from filebeat and other beats. Thank you. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 13, 2017, 7:38am UTC](https://discuss.elastic.co/t/filebeat-not-sending-logs-to-logstash-versions-5-4-1/89366/12 "2017-07-13T07:38:15Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.