# Filebeat unable to send logs to logstash **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [June 5, 2017, 5:52am UTC](https://discuss.elastic.co/t/filebeat-unable-to-send-logs-to-logstash/88224 "2017-06-05T05:52:55Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Sujith](https://avatars.discourse-cdn.com/v4/letter/s/77aa72/32.png) [@Sujith](https://discuss.elastic.co/u/Sujith)\ **Post date:** [June 5, 2017, 5:52am UTC](https://discuss.elastic.co/t/filebeat-unable-to-send-logs-to-logstash/88224/1 "2017-06-05T05:52:56Z")
Hi Team, While sending logs from one server to another server, i'm getting below error in filebeat. I'm using ELK 5.4 version and i'm sending logs through below order. filebeat-\>logstash-\>elasticsearch Since filebeat unable to connect to logstash from one server to another server, please fine below logs in filebeat. 2017-06-05T06:48:36+01:00 DBG output worker: publish 1987 events 2017-06-05T06:48:36+01:00 DBG connect 2017-06-05T06:48:37+01:00 DBG End of file reached: E:\IBMWAS\WebSphere\AppServer\profiles\AppSrv01\logs\server1\SystemOut.log; Backoff now. 2017-06-05T06:48:38+01:00 ERR Connecting error publishing events (retrying): dial tcp 10.209.68.107:5044: connectex: No connection could be made because the target machine actively refused it. 2017-06-05T06:48:38+01:00 DBG send fail 2017-06-05T06:48:39+01:00 DBG connect 2017-06-05T06:48:39+01:00 DBG End of file reached: E:\IBMWAS\WebSphere\AppServer\profiles\AppSrv01\logs\server1\SystemOut.log; Backoff now. 2017-06-05T06:48:40+01:00 ERR Connecting error publishing events (retrying): dial tcp 10.209.68.107:5044: connectex: No connection could be made because the target machine actively refused it. 2017-06-05T06:48:40+01:00 DBG send fail 2017-06-05T06:48:41+01:00 DBG Run prospector 2017-06-05T06:48:41+01:00 DBG Start next scan 2017-06-05T06:48:41+01:00 DBG Check file for harvesting: E:\IBMWAS\WebSphere\AppServer\profiles\AppSrv01\logs\server1\SystemOut.log 2017-06-05T06:48:41+01:00 DBG Update existing file for harvesting: E:\IBMWAS\WebSphere\AppServer\profiles\AppSrv01\logs\server1\SystemOut.log, offset: 404461 2017-06-05T06:48:41+01:00 DBG Harvester for file is still running: E:\IBMWAS\WebSphere\AppServer\profiles\AppSrv01\logs\server1\SystemOut.log 2017-06-05T06:48:41+01:00 DBG Prospector states cleaned up. Before: 1, After: 1 2017-06-05T06:48:41+01:00 DBG Flushing spooler because of timeout. Events flushed: 1357 2017-06-05T06:48:42+01:00 DBG connect 2017-06-05T06:48:43+01:00 DBG End of file reached: E:\IBMWAS\WebSphere\AppServer\profiles\AppSrv01\logs\server1\SystemOut.log; Backoff now. 2017-06-05T06:48:44+01:00 ERR Connecting error publishing events (retrying): dial tcp 10.209.68.107:5044: connectex: No connection could be made because the target machine actively refused it. 2017-06-05T06:48:44+01:00 DBG send fail please help us to send logs to logstash, let us know what was the problem please. ---
**Author:** ![tomer](https://avatars.discourse-cdn.com/v4/letter/t/41988e/32.png) [@tomer](https://discuss.elastic.co/u/tomer)\ **Post date:** [June 5, 2017, 6:13am UTC](https://discuss.elastic.co/t/filebeat-unable-to-send-logs-to-logstash/88224/2 "2017-06-05T06:13:45Z")
Hi, did you check that the firewall excepts transportation on the port which LS is working? ---
**Author:** ![Sujith](https://avatars.discourse-cdn.com/v4/letter/s/77aa72/32.png) [@Sujith](https://discuss.elastic.co/u/Sujith)\ **Post date:** [June 5, 2017, 6:45am UTC](https://discuss.elastic.co/t/filebeat-unable-to-send-logs-to-logstash/88224/3 "2017-06-05T06:45:30Z")
hello tomer, let me know how to check firewall excepts transportation on the port which LS is working? ---
**Author:** ![tomer](https://avatars.discourse-cdn.com/v4/letter/t/41988e/32.png) [@tomer](https://discuss.elastic.co/u/tomer)\ **Post date:** [June 5, 2017, 6:49am UTC](https://discuss.elastic.co/t/filebeat-unable-to-send-logs-to-logstash/88224/4 "2017-06-05T06:49:23Z")
Hi, I am no expert in this, I am working on a lab machine in our company therefor I am able to turn off the firewall here and check it. The correct way to do it, is to open the port to the correct port (most likely 5044), and this you will need some one else to answer or through google. to turn off the firewall all together in centos 6 do: service iptables stop ---
**Author:** ![Sujith](https://avatars.discourse-cdn.com/v4/letter/s/77aa72/32.png) [@Sujith](https://discuss.elastic.co/u/Sujith)\ **Post date:** [June 5, 2017, 10:04am UTC](https://discuss.elastic.co/t/filebeat-unable-to-send-logs-to-logstash/88224/5 "2017-06-05T10:04:49Z")
Hi Team, I have noticed that filebeat logs are been sending to logstash now working fine. i have figured out that due to xpack security is true in elasticsearch config file, the connection was not happening between filebeat and logstash whereas i disabled xpack security to false and can see logs are being published properly. Please let us know how we send logs from filebeat to logstash and to elasticsearch making xpack security true. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 3, 2017, 10:04am UTC](https://discuss.elastic.co/t/filebeat-unable-to-send-logs-to-logstash/88224/6 "2017-07-03T10:04:52Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.