Filebeat statup error

Elastic Stack Logstash
1

Following this offical doc(https://www.elastic.co/guide/en/logstash/5.4/advanced-pipeline.html) to run filebeat hits the folllowing error:

./filebeat -e -c filebeat.yml -d "publish"

2017/08/02 08:15:24.372074 output.go:109: DBG output worker: publish 50 events
2017/08/02 08:15:24.451565 single.go:140: ERR Connecting error publishing events (retrying): Get http://localhost:5043: read tcp 127.0.0.1:36296->127.0.0.1:5043: read: connection reset by peer

first-pipeline.conf:
input {
beats {
port => "5043"
}
}
filter {
grok {
match => { "message" => "%{COMBINEDAPACHELOG}"}
}
geoip {
source => "clientip"
}
}
output {
elasticsearch {
hosts => [ "localhost:9200" ]
}
}

filebeat.prospectors:

  • input_type: log
    • /home/mysqlmove/logstash-5.5.1/*.log
      output.elasticsearch:
      hosts: ["localhost:5043"]

any advice wourld be appreciated

2

If you want Filebeat to send to Logstash you need to configure it to use a Logstash output instead of an Elasticsearch output.

https://www.elastic.co/guide/en/beats/filebeat/current/config-filebeat-logstash.html

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.