Filebeat unable to send logs to logstash

Elastic Stack Beats
1

Hi Team,

While sending logs from one server to another server, i'm getting below error in filebeat.

I'm using ELK 5.4 version and i'm sending logs through below order.

filebeat->logstash->elasticsearch

Since filebeat unable to connect to logstash from one server to another server, please fine below logs in filebeat.

2017-06-05T06:48:36+01:00 DBG output worker: publish 1987 events
2017-06-05T06:48:36+01:00 DBG connect
2017-06-05T06:48:37+01:00 DBG End of file reached: E:\IBMWAS\WebSphere\AppServer\profiles\AppSrv01\logs\server1\SystemOut.log; Backoff now.
2017-06-05T06:48:38+01:00 ERR Connecting error publishing events (retrying): dial tcp 10.209.68.107:5044: connectex: No connection could be made because the target machine actively refused it.
2017-06-05T06:48:38+01:00 DBG send fail
2017-06-05T06:48:39+01:00 DBG connect
2017-06-05T06:48:39+01:00 DBG End of file reached: E:\IBMWAS\WebSphere\AppServer\profiles\AppSrv01\logs\server1\SystemOut.log; Backoff now.
2017-06-05T06:48:40+01:00 ERR Connecting error publishing events (retrying): dial tcp 10.209.68.107:5044: connectex: No connection could be made because the target machine actively refused it.
2017-06-05T06:48:40+01:00 DBG send fail
2017-06-05T06:48:41+01:00 DBG Run prospector
2017-06-05T06:48:41+01:00 DBG Start next scan
2017-06-05T06:48:41+01:00 DBG Check file for harvesting: E:\IBMWAS\WebSphere\AppServer\profiles\AppSrv01\logs\server1\SystemOut.log
2017-06-05T06:48:41+01:00 DBG Update existing file for harvesting: E:\IBMWAS\WebSphere\AppServer\profiles\AppSrv01\logs\server1\SystemOut.log, offset: 404461
2017-06-05T06:48:41+01:00 DBG Harvester for file is still running: E:\IBMWAS\WebSphere\AppServer\profiles\AppSrv01\logs\server1\SystemOut.log
2017-06-05T06:48:41+01:00 DBG Prospector states cleaned up. Before: 1, After: 1
2017-06-05T06:48:41+01:00 DBG Flushing spooler because of timeout. Events flushed: 1357
2017-06-05T06:48:42+01:00 DBG connect
2017-06-05T06:48:43+01:00 DBG End of file reached: E:\IBMWAS\WebSphere\AppServer\profiles\AppSrv01\logs\server1\SystemOut.log; Backoff now.
2017-06-05T06:48:44+01:00 ERR Connecting error publishing events (retrying): dial tcp 10.209.68.107:5044: connectex: No connection could be made because the target machine actively refused it.
2017-06-05T06:48:44+01:00 DBG send fail

please help us to send logs to logstash, let us know what was the problem please.

2

Hi, did you check that the firewall excepts transportation on the port which LS is working?

3

hello tomer,

let me know how to check firewall excepts transportation on the port which LS is working?

4

Hi,

I am no expert in this, I am working on a lab machine in our company therefor I am able to turn off the firewall here and check it. The correct way to do it, is to open the port to the correct port (most likely 5044), and this you will need some one else to answer or through google.

to turn off the firewall all together in centos 6 do: service iptables stop

5

Hi Team,

I have noticed that filebeat logs are been sending to logstash now working fine.

i have figured out that due to xpack security is true in elasticsearch config file, the connection was not happening between filebeat and logstash whereas i disabled xpack security to false and can see logs are being published properly.

Please let us know how we send logs from filebeat to logstash and to elasticsearch making xpack security true.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.