Filebeat to logstash - connectivity issue

Elastic Stack Beats
1

Versions used:
logstash - 7.3.1
filebeat - 7.3.1

the entire elastic stack is running in on same server. I am facing issue while trying to send data from filebeat to logstash.

2019-08-25T21:34:21.900-0300    INFO    log/input.go:148        Configured paths: [C:\Users\845918\Desktop\New folder\1209\*.log]
2019-08-25T21:34:21.901-0300    INFO    input/input.go:114      Starting input of type: log; ID: 573940448417788428
2019-08-25T21:34:21.901-0300    INFO    crawler/crawler.go:106  Loading and starting Inputs completed. Enabled inputs: 1
2019-08-25T21:34:21.907-0300    INFO    log/harvester.go:253    Harvester started for file: C:\Users\845918\Desktop\New folder\1209\app.log
2019-08-25T21:34:21.947-0300    INFO    pipeline/output.go:95   Connecting to backoff(async(tcp://localhost:5601))
2019-08-25T21:34:23.998-0300    INFO    pipeline/output.go:105  Connection to backoff(async(tcp://localhost:5601)) established
2019-08-25T21:34:24.049-0300    ERROR   logstash/async.go:256   Failed to publish events caused by: lumberjack protocol error
2019-08-25T21:34:24.088-0300    ERROR   logstash/async.go:256   Failed to publish events caused by: client is not connected
2019-08-25T21:34:25.810-0300    ERROR   pipeline/output.go:121  Failed to publish events: client is not connected

filebeat.yml:

filebeat.inputs:
- type: log
  enabled: true
  paths:
    - C:\Users\845918\Desktop\New folder\1209\*.log

output.logstash:
  hosts: ["localhost:5601"]

first-pipeline.conf:

input {
beats {
port => 5601
}
}

output {
elasticsearch {
hosts => ["http://localhost:9200"]
#index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
#user => "elastic"
#password => "changeme"
}
}

can someone guide on how to fix this issue. Thanks

2

5601 is the default kibana port, do you have kibana running on the same server?

Any errors in the logstash log?

3

Change Filebeat.yml

output.logstash:
hosts: ["localhost:5044"]

Change Logstash config

input {
  beats {
    port => 5044
  }
}

output {
	stdout { 
	     codec => rubydebug { } 
	}
}

Start Logstash from executable and pass the config file (following command on Linux .. adjust for Windows)
/usr/share/logstash/bin/logstash --path.config /home/kumar/Desktop/test.conf --config.reload.automatic

The output will be displayed on stdout. This is easiest for debugging

Logstash config test

/usr/share/logstash/bin/logstash --config.test_and_exit -f /etc/logstash/conf.d/logstash.conf

4

Thanks. The issue was caused due to port numbers. Got fixed after updating the same

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.