Filebeat refuse connect to Logstash port- "Connection timed out error"

Elastic Stack Beats
1 
Hi all, 
I have installed FB on Linux server and LG on my local server. (ES and Kibana installed on local server as well)

**LG configuration:**   
input{
	beats{
		port => 5044
	}
}	
output {
  elasticsearch {
    hosts => ["http://localhost:9200"]
    index => "%{[@metadata][beat]}-%{[@metadata][version]}" 
  }
}

**FB configuration:**
filebeat.inputs:
- type: log
  enabled: true
  paths:
  - /opt/tomcat/logs/catalina.out
output.logstash:
  hosts: ["192.168.220.33:5044"] 

**More details:** 
I'm connecting to the FB server from my pc which working with VPN the VPN's ip-  192.168.220.33 (as written in FB config). 
The LG working fine, i check configuration for LG and it's OK, and seems that it's listening to port 5044. However than trying to check connection on FB: "telnet 192.168.220.33  5044"
I get:
"try to connect" and after few seconds  "Connection timed out error".

 I check some tutorials on this site so i try as well, this what i got:
* I turn off Firewall for public and social connection, not working. 
* try to run FB- "sudo chown root filebeat.yml => sudo ./filebeat -e"- ERROR   
          pipeline/output.go:100  Failed to connect to backoff(async(tcp://192.168.220.33:5044)): dial 
          tcp 192.168.220.33:5044: i/o timeout
* ping 192.168.220.33 -"PING 192.168.220.33 (192.168.220.33) 56(84) bytes of data".
2

Hi @pash123, welcome to the Elastic community forums!

Yes, I suspect this has to do with firewall rules between your Filebeat and Logstash hosts. I see that ping worked but that just means that ICMP echo requests are being allowed. We need to check if TCP requests to port 5044 are allowed from your Filebeat host to your Logstash host.

What happens if you run the following on your Filebeat host?

telnet 192.168.220.33 5044
3

Hi @shaunak,

thanks for responding, as i describe in the issue then running: telnet 192.168.220.33 5044 i get this:

Trying 192.168.220.33...

telnet: connect to address 192.168.220.33: Connection timed out


בלי וירוסים. www.avast.com

‫בתאריך יום ב׳, 20 באפר׳ 2020 ב-22:09 מאת ‪Shaunak Kashyap via Discuss the Elastic Stack‬‏ <‪elastic@discoursemail.com‬‏>:‬

4

The connection timed out can indicate one of two things:

  • either there is a networking issue somewhere between your Filebeat host and your Logstash host, or
  • there is nothing listening on port 5044 on your Logstash host.

What happens if you run telnet localhost 5044 on your Logstash host? Does that work? If so then we know it's some networking issue between your Filebeat host and your Logstash host.

5 
I run the LG config file:
bin\logstash.bat -f C:\Users\pavel\OneDrive\Desktop\ELK\logstash-7.6.2\config\logstash.conf

this is the LS config file:
input{
	beats{
		port => 5044
	}
}
	
output {
  elasticsearch {
    hosts => ["http://localhost:9200"]
    index => "%{[@metadata][beat]}-%{[@metadata][version]}" 
  }
}

After i run this: 
C:\Windows\system32>netstat -na | find "5044"
  TCP    0.0.0.0:5044           0.0.0.0:0              LISTENING
  TCP    [::]:5044              [::]:0                 LISTENING
6

Thanks. The 0.0.0.0 proves that Logstash is listening on port 5044 on all IP addresses assigned to the Logstash host. Is 192.168.220.33 one of those IP addresses? I'm not sure how to check that on Windows. If it is, then I'd check the Windows firewall configuration — is TCP port 5044 open to receiving connections from the outside?

7

Hey, can I assigned this ip:192.168.220.33 on the logStash config file?
P.S
This ip:192.168.220.33 is my vpn ip.

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.