# Filebeat unable to connect to logstash

**URL:** <https://discuss.elastic.co/t/filebeat-unable-to-connect-to-logstash/65085>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [November 5, 2016, 5:31am UTC](https://discuss.elastic.co/t/filebeat-unable-to-connect-to-logstash/65085 "2016-11-05T05:31:35Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Elias\_Lim](https://avatars.discourse-cdn.com/v4/letter/e/ea666f/32.png) [@Elias\_Lim](https://discuss.elastic.co/u/Elias_Lim)\
**Post date:** [November 5, 2016, 5:31am UTC](https://discuss.elastic.co/t/filebeat-unable-to-connect-to-logstash/65085/1 "2016-11-05T05:31:35Z")

</div>

Hello,

I'm using ELK ver.5.0 on a server and Filebeat ver.5.0 on my client server. I've followed the setup and config tutorials and managed to get everything running. However, it seems like I'm unable to connect filebeat to logstash.  
This is what I see in my filebeat log:

```
2016-11-05T13:15:08+08:00 INFO Starting Registrar
2016-11-05T13:15:08+08:00 INFO Start sending events to output
2016-11-05T13:15:08+08:00 INFO Starting spooler: spool_size: 2048; idle_timeout: 5s
2016-11-05T13:15:08+08:00 ERR Connecting error publishing events (retrying): dial tcp 10.0.0.87:5044: getsockopt: connection refused
2016-11-05T13:15:09+08:00 ERR Connecting error publishing events (retrying): dial tcp 10.0.0.87:5044: getsockopt: connection refused
2016-11-05T13:15:11+08:00 ERR Connecting error publishing events (retrying): dial tcp 10.0.0.87:5044: getsockopt: connection refused
2016-11-05T13:15:15+08:00 ERR Connecting error publishing events (retrying): dial tcp 10.0.0.87:5044: getsockopt: connection refused
2016-11-05T13:15:23+08:00 ERR Connecting error publishing events (retrying): dial tcp 10.0.0.87:5044: getsockopt: connection refused
2016-11-05T13:15:38+08:00 INFO Non-zero metrics in the last 30s: filebeat.harvester.started=1 libbeat.publisher.published_events=2047 filebeat.harvester.open_files=1 filebeat.harvester.running=1
2016-11-05T13:15:39+08:00 ERR Connecting error publishing events (retrying): dial tcp 10.0.0.87:5044: getsockopt: connection refused

```

Also, it seems like port 5044 is not included when i checked my ports that are listening.

My filebeat.yml:

```
filebeat.prospectors:
- input_type: log
  paths:
    - /var/log/apache2/error.log
output.logstash:
  hosts: []

```

My logstash-beats-input.conf:

```
input {
  beats {
    port => 5044
  }
} 

```

Thanks!

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [November 5, 2016, 5:32am UTC](https://discuss.elastic.co/t/filebeat-unable-to-connect-to-logstash/65085/2 "2016-11-05T05:32:25Z")

</div>

Can you telnet from the FB host to the LS one on that port?

---

<div class="post-metadata">

**Author:** ![Elias\_Lim](https://avatars.discourse-cdn.com/v4/letter/e/ea666f/32.png) [@Elias\_Lim](https://discuss.elastic.co/u/Elias_Lim)\
**Post date:** [November 5, 2016, 6:44am UTC](https://discuss.elastic.co/t/filebeat-unable-to-connect-to-logstash/65085/3 "2016-11-05T06:44:35Z")

</div>

I get Unable to connect. Connection refused.  
Logstash is still running though.

---

<div class="post-metadata">

**Author:** ![Elias\_Lim](https://avatars.discourse-cdn.com/v4/letter/e/ea666f/32.png) [@Elias\_Lim](https://discuss.elastic.co/u/Elias_Lim)\
**Post date:** [November 5, 2016, 6:55am UTC](https://discuss.elastic.co/t/filebeat-unable-to-connect-to-logstash/65085/4 "2016-11-05T06:55:26Z")

</div>

Hi warkolm, i found my mistake! It was an indentation in the logstash.yml file. But thank you anyway for your prompt reply!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 3, 2016, 6:55am UTC](https://discuss.elastic.co/t/filebeat-unable-to-connect-to-logstash/65085/5 "2016-12-03T06:55:26Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.