# Filebeat refuse the connection with logstash **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [January 10, 2017, 9:02am UTC](https://discuss.elastic.co/t/filebeat-refuse-the-connection-with-logstash/71038 "2017-01-10T09:02:42Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![shubhrant](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shubhrant/32/20310_2.png) [@shubhrant](https://discuss.elastic.co/u/shubhrant)\ **Post date:** [January 10, 2017, 9:02am UTC](https://discuss.elastic.co/t/filebeat-refuse-the-connection-with-logstash/71038/1 "2017-01-10T09:02:42Z")
while shipping the log filebeat give an error i.e. **INFO Connecting error publishing events (retrying): dial tcp 10.228.13.59:5044: getsockopt: connection refused** my logstash configuration file is input { beats { port =\> 5044 } } filter { if [type] == "syslog" { grok { match =\> { "message" =\> "%{SYSLOGTIMESTAMP:syslog\_timestamp} %{SYSLOGHOST:syslog\_hostname} %{DATA:syslog\_program}(?:[%{POSINT:syslog\_pid}])?: %{GREEDYDATA:syslog\_message}" } add\_field =\> ["received\_at", "%{@timestamp}"] add\_field =\> ["received\_from", "%{host}"] } syslog\_pri { } date { match =\> ["syslog\_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"] } } if [type] == "apache-access" { grok { match =\> { "message" =\> "%{COMBINEDAPACHELOG}" } } } } output { elasticsearch { hosts =\> "localhost:9200" } } and filebeat configuration file is output: ### Logstash as output logstash: # The Logstash hosts hosts: ["10.228.13.59:5044"] TLS is not enabled ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [January 10, 2017, 10:02am UTC](https://discuss.elastic.co/t/filebeat-refuse-the-connection-with-logstash/71038/2 "2017-01-10T10:02:28Z")
- Verify that Logstash really is listening on port 5044 (use e.g. netstat). - Verify that there's no firewall blocking the access. ---
**Author:** ![shubhrant](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shubhrant/32/20310_2.png) [@shubhrant](https://discuss.elastic.co/u/shubhrant)\ **Post date:** [January 10, 2017, 10:16am UTC](https://discuss.elastic.co/t/filebeat-refuse-the-connection-with-logstash/71038/3 "2017-01-10T10:16:56Z")
yes firewall is ok and logstash listening port 5044 ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [January 10, 2017, 10:25am UTC](https://discuss.elastic.co/t/filebeat-refuse-the-connection-with-logstash/71038/4 "2017-01-10T10:25:14Z")
So `telnet 10.228.13.59 5044` works? ---
**Author:** ![niks](https://avatars.discourse-cdn.com/v4/letter/n/e19b73/32.png) [@niks](https://discuss.elastic.co/u/niks)\ **Post date:** [January 10, 2017, 11:23am UTC](https://discuss.elastic.co/t/filebeat-refuse-the-connection-with-logstash/71038/5 "2017-01-10T11:23:36Z")
yes it works ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [January 10, 2017, 12:22pm UTC](https://discuss.elastic.co/t/filebeat-refuse-the-connection-with-logstash/71038/6 "2017-01-10T12:22:37Z")
did you run telnet from the machine filebeat is running on? The error is generated by the OS, as the OS could not establish a connection on TCP level. ---
**Author:** ![shubhrant](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shubhrant/32/20310_2.png) [@shubhrant](https://discuss.elastic.co/u/shubhrant)\ **Post date:** [January 11, 2017, 5:26am UTC](https://discuss.elastic.co/t/filebeat-refuse-the-connection-with-logstash/71038/7 "2017-01-11T05:26:09Z")
thanks for the reply now i'm not able to connect telnet connection and also I've checked the logstash log file the error is "2017-01-11T10:46:15,840][WARN][logstash.outputs.elasticsearch] Elasticsearch output attempted to sniff for new connections but cannot. No living connections are detected. Pool contains the following current URLs {:url\_info=\>{}} [2017-01-11T10:46:19,012][WARN][logstash.shutdownwatcher] {} " ---
**Author:** ![shubhrant](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shubhrant/32/20310_2.png) [@shubhrant](https://discuss.elastic.co/u/shubhrant)\ **Post date:** [January 11, 2017, 5:26am UTC](https://discuss.elastic.co/t/filebeat-refuse-the-connection-with-logstash/71038/8 "2017-01-11T05:26:43Z")
no it is not working "telnet 10.228.13.59 5044" ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [January 11, 2017, 6:37am UTC](https://discuss.elastic.co/t/filebeat-refuse-the-connection-with-logstash/71038/9 "2017-01-11T06:37:37Z")
> no it is not working "telnet 10.228.13.59 5044" If Logstash indeed is running it seems you have a network issue. That's hard for us to debug. ---
**Author:** ![shubhrant](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shubhrant/32/20310_2.png) [@shubhrant](https://discuss.elastic.co/u/shubhrant)\ **Post date:** [January 11, 2017, 6:42am UTC](https://discuss.elastic.co/t/filebeat-refuse-the-connection-with-logstash/71038/10 "2017-01-11T06:42:33Z")
thank you sir but now telnet connection is working fine and also the connection refuse error is not coming in filebeat.... but still log is not coming one more thing is that while using this command "curl -XGET '[http://localhost:9200/filebeat-\*/\_search?pretty](http://localhost:9200/filebeat-*/_search?pretty)'" o/p is coming ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [January 11, 2017, 9:32am UTC](https://discuss.elastic.co/t/filebeat-refuse-the-connection-with-logstash/71038/11 "2017-01-11T09:32:54Z")
> thank you sir but now telnet connection is working fine and also the connection refuse error is not coming in filebeat.... but still log is not coming What's in Logstash's log? The "No living connections are detected" message you posted earlier is probably not the only interesting message. What does your elasticsearch output plugin configuration look like? > one more thing is that while using this command "curl -XGET '[http://localhost:9200/filebeat-\*/\_search?pretty](http://localhost:9200/filebeat-*/_search?pretty)'" o/p is coming "o/p"? ---
**Author:** ![shubhrant](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shubhrant/32/20310_2.png) [@shubhrant](https://discuss.elastic.co/u/shubhrant)\ **Post date:** [January 11, 2017, 9:57am UTC](https://discuss.elastic.co/t/filebeat-refuse-the-connection-with-logstash/71038/12 "2017-01-11T09:57:15Z")
Thanks for your valuable time sir now everything is fine 😃 thankyou for your suggestion i think problem is, filebeat was not communicating with 5044/tcp I enable that in ufw after that telnet connection start working. Now I'm working on GeoIP field so once again thank you 🙂 ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 8, 2017, 9:57am UTC](https://discuss.elastic.co/t/filebeat-refuse-the-connection-with-logstash/71038/13 "2017-02-08T09:57:39Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.