# Filebeat vs Logstash **URL:** \ **Category:** Logstash\ **Created:** [April 10, 2018, 12:57pm UTC](https://discuss.elastic.co/t/filebeat-vs-logstash/127485 "2018-04-10T12:57:05Z")\ **Posts on this page:** 20\ **Page:** 2
**Author:** ![jawad846](https://avatars.discourse-cdn.com/v4/letter/j/edb3f5/32.png) [@jawad846](https://discuss.elastic.co/u/jawad846)\ **Post date:** [April 12, 2018, 8:04am UTC](https://discuss.elastic.co/t/filebeat-vs-logstash/127485/21 "2018-04-12T08:04:33Z")
i run this command from the path folder, i saved logstash.conf in /bin/logstash i run from on that folder ---
**Author:** ![harshbajaj16](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/harshbajaj16/32/44970_2.png) [@harshbajaj16](https://discuss.elastic.co/u/harshbajaj16)\ **Post date:** [April 12, 2018, 8:11am UTC](https://discuss.elastic.co/t/filebeat-vs-logstash/127485/22 "2018-04-12T08:11:05Z")
Pls save your file in conf.d folder instead of bin folder. ---
**Author:** ![jawad846](https://avatars.discourse-cdn.com/v4/letter/j/edb3f5/32.png) [@jawad846](https://discuss.elastic.co/u/jawad846)\ **Post date:** [April 12, 2018, 8:20am UTC](https://discuss.elastic.co/t/filebeat-vs-logstash/127485/23 "2018-04-12T08:20:08Z")
done, getting this error in filebeat 2018-04-12T08:18:28.356Z ERROR pipeline/output.go:74 Failed to connect: dial tcp 192.168.2.79:5044: getsockopt: connection refused ---
**Author:** ![sancroth](https://avatars.discourse-cdn.com/v4/letter/s/838e76/32.png) [@sancroth](https://discuss.elastic.co/u/sancroth)\ **Post date:** [April 12, 2018, 8:36am UTC](https://discuss.elastic.co/t/filebeat-vs-logstash/127485/24 "2018-04-12T08:36:11Z")
Please make sure that **/etc/logstash/logstash.yml** (you have a typo on your replies, /etc/ **logastash** /,so can't be sure if it was a typo or folder is named like this) exists with the paths to data and logs being correct. After running /bin/logstash -f /path/to/logstash.conf of yours try: `nestat -anutp | grep 5044` and give us the output. Also any chance you have installed the xpack plugin on logstash? ---
**Author:** ![harshbajaj16](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/harshbajaj16/32/44970_2.png) [@harshbajaj16](https://discuss.elastic.co/u/harshbajaj16)\ **Post date:** [April 12, 2018, 8:48am UTC](https://discuss.elastic.co/t/filebeat-vs-logstash/127485/25 "2018-04-12T08:48:32Z")
> [@jawad846](#): > > hosts: ["192.168.2.81:5044"] Hi @jawad846 please check that you have mentioned correct Ip in your filebeat.yml. bcoz in your filebeat.yml Ip is 81 and in error its its 79. > [@jawad846](#): > > dial tcp 192.168.2.79:5044: can you pls check and confirm the same. Thanks, Harsh Bajaj ---
**Author:** ![jawad846](https://avatars.discourse-cdn.com/v4/letter/j/edb3f5/32.png) [@jawad846](https://discuss.elastic.co/u/jawad846)\ **Post date:** [April 12, 2018, 9:05am UTC](https://discuss.elastic.co/t/filebeat-vs-logstash/127485/26 "2018-04-12T09:05:29Z")
filebeat is @ 192.168.2.223 and logstash is @ 192.168.2.79 @harshbajaj16 ---
**Author:** ![jawad846](https://avatars.discourse-cdn.com/v4/letter/j/edb3f5/32.png) [@jawad846](https://discuss.elastic.co/u/jawad846)\ **Post date:** [April 12, 2018, 9:13am UTC](https://discuss.elastic.co/t/filebeat-vs-logstash/127485/27 "2018-04-12T09:13:53Z")
**root@ip-192-168-2-79:/usr/share/logstash# bin/logstash -f /usr/share/logstash/logs.conf** WARNING: Could not find logstash.yml which is typically located in $LS\_HOME/config or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults Could not find log4j2 configuration at path /usr/share/logstash/config/log4j2.properties. Using default config which logs errors to the console [INFO] 2018-04-12 09:09:10.902 [main] scaffold - Initializing module {:module\_name=\>"fb\_apache", :directory=\>"/usr/share/logstash/modules/fb\_apache/configuration"} [INFO] 2018-04-12 09:09:11.227 [main] scaffold - Initializing module {:module\_name=\>"netflow", :directory=\>"/usr/share/logstash/modules/netflow/configuration"} [WARN] 2018-04-12 09:09:23.459 [LogStash::Runner] multilocal - Ignoring the 'pipelines.yml' file because modules or command line options are specified [INFO] 2018-04-12 09:09:28.562 [LogStash::Runner] runner - Starting Logstash {"logstash.version"=\>"6.2.3"} [INFO] 2018-04-12 09:09:36.210 [Api Webserver] agent - Successfully started Logstash API endpoint {:port=\>9600} [ERROR] 2018-04-12 09:09:39.862 [Ruby-0-Thread-1: /usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/stud-0.0.23/lib/stud/task.rb:22] agent - Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"LogStash::ConfigurationError", :message=\>"Expected one of #, { at line 7, column 2 (byte 45) after filter\n\t", :backtrace=\>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:42:in `compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:50:in`compile\_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:12:in `block in compile_sources'", "org/jruby/RubyArray.java:2486:in`map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in `compile_sources'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:51:in`initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:169:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:40:in`execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:315:in `block in converge_state'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:141:in`with\_pipelines'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:312:in `block in converge_state'", "org/jruby/RubyArray.java:1734:in`each'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:299:in `converge_state'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:166:in`block in converge\_state\_and\_update'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:141:in `with_pipelines'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:164:in`converge\_state\_and\_update'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:90:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:348:in`block in execute'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/stud-0.0.23/lib/stud/task.rb:24:in `block in initialize'"]} netstat -anutp | grep 5044 this command is giving any answer, I main issue i realised that, port is not open @sancroth root@ip-192-168-2-79:/usr/share/logstash# netstat -plnt Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 0.0.0.0:22 0.0.0.0:\* LISTEN 1331/sshd tcp6 0 0 :::22 :::\* LISTEN 1331/sshd ---
**Author:** ![harshbajaj16](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/harshbajaj16/32/44970_2.png) [@harshbajaj16](https://discuss.elastic.co/u/harshbajaj16)\ **Post date:** [April 12, 2018, 9:16am UTC](https://discuss.elastic.co/t/filebeat-vs-logstash/127485/28 "2018-04-12T09:16:56Z")
And in filebeat.yml you have give the right IP of logstash o/p which is : > [@jawad846](#): > > 192.168.2.79 bcoz in earlier file you given 81 IP...? ---
**Author:** ![jawad846](https://avatars.discourse-cdn.com/v4/letter/j/edb3f5/32.png) [@jawad846](https://discuss.elastic.co/u/jawad846)\ **Post date:** [April 12, 2018, 9:17am UTC](https://discuss.elastic.co/t/filebeat-vs-logstash/127485/29 "2018-04-12T09:17:47Z")
i were working with aws linux, now am testing in ubuntu @harshbajaj16 ---
**Author:** ![sancroth](https://avatars.discourse-cdn.com/v4/letter/s/838e76/32.png) [@sancroth](https://discuss.elastic.co/u/sancroth)\ **Post date:** [April 12, 2018, 9:18am UTC](https://discuss.elastic.co/t/filebeat-vs-logstash/127485/30 "2018-04-12T09:18:30Z")
As you can see there is a typo in your logstash configuration `LogStash::ConfigurationError", :message=>"Expected one of #, { at line 7, column 2 (byte 45) after filter\n\t"` that makes logstash fail. Thus the port is nevr open since logstash is not actually working. Could you give me your configurations in a formated way so i can read them? Try [pastebin.com](http://pastebin.com) ---
**Author:** ![jawad846](https://avatars.discourse-cdn.com/v4/letter/j/edb3f5/32.png) [@jawad846](https://discuss.elastic.co/u/jawad846)\ **Post date:** [April 12, 2018, 9:19am UTC](https://discuss.elastic.co/t/filebeat-vs-logstash/127485/31 "2018-04-12T09:19:28Z")
when i run the command /filebeat -e apache2 the apache2 module is enabled the o/p | 2018-04-12T09:02:11.564Z | ERROR | pipeline/output.go:74 | Failed to connect: dial tcp 192.168.2.79:5044: getsockopt: connection refused | | --- | --- | --- | --- | | 2018-04-12T09:02:13.585Z | ERROR | pipeline/output.go:74 | Failed to connect: dial tcp 192.168.2.79:5044: getsockopt: connection refused | ---
**Author:** ![jawad846](https://avatars.discourse-cdn.com/v4/letter/j/edb3f5/32.png) [@jawad846](https://discuss.elastic.co/u/jawad846)\ **Post date:** [April 12, 2018, 9:22am UTC](https://discuss.elastic.co/t/filebeat-vs-logstash/127485/32 "2018-04-12T09:22:55Z")
u mean logstash.yml file? @sancroth ---
**Author:** ![sancroth](https://avatars.discourse-cdn.com/v4/letter/s/838e76/32.png) [@sancroth](https://discuss.elastic.co/u/sancroth)\ **Post date:** [April 12, 2018, 9:23am UTC](https://discuss.elastic.co/t/filebeat-vs-logstash/127485/33 "2018-04-12T09:23:11Z")
This is expected behavior since logstash is currently dead. Please do what i said on my last post. Copy and paste your logstash.conf(input-filters-output file) on [pastebin.com](http://pastebin.com) , save it for an hour or more and give us your link. ---
**Author:** ![harshbajaj16](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/harshbajaj16/32/44970_2.png) [@harshbajaj16](https://discuss.elastic.co/u/harshbajaj16)\ **Post date:** [April 12, 2018, 9:23am UTC](https://discuss.elastic.co/t/filebeat-vs-logstash/127485/34 "2018-04-12T09:23:46Z")
ohk check one more thing that your logstash is working and running up or not??? ---
**Author:** ![sancroth](https://avatars.discourse-cdn.com/v4/letter/s/838e76/32.png) [@sancroth](https://discuss.elastic.co/u/sancroth)\ **Post date:** [April 12, 2018, 9:24am UTC](https://discuss.elastic.co/t/filebeat-vs-logstash/127485/35 "2018-04-12T09:24:36Z")
It's not working, he posted his logs from logstash. There is a configuration error that gives the typical logstash start-die loop. ---
**Author:** ![jawad846](https://avatars.discourse-cdn.com/v4/letter/j/edb3f5/32.png) [@jawad846](https://discuss.elastic.co/u/jawad846)\ **Post date:** [April 12, 2018, 9:24am UTC](https://discuss.elastic.co/t/filebeat-vs-logstash/127485/36 "2018-04-12T09:24:54Z")
@sancroth file---\> /usr/share/logstash/logstash.conf input { beats { port =\> 5044 } } filter grok { match =\> { "message" =\> "%{COMBINEDAPACHELOG}"} } } output { stdout { codec =\> rubydebug } } ---
**Author:** ![sancroth](https://avatars.discourse-cdn.com/v4/letter/s/838e76/32.png) [@sancroth](https://discuss.elastic.co/u/sancroth)\ **Post date:** [April 12, 2018, 9:26am UTC](https://discuss.elastic.co/t/filebeat-vs-logstash/127485/37 "2018-04-12T09:26:10Z")
input { beats { port =\> 5044 } } filter{ # \<- here grok { match =\> { "message" =\> "%{COMBINEDAPACHELOG}"} } } output { stdout { codec =\> rubydebug } } Your filter is missing the opening curly bracket "{". The above is correct ---
**Author:** ![harshbajaj16](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/harshbajaj16/32/44970_2.png) [@harshbajaj16](https://discuss.elastic.co/u/harshbajaj16)\ **Post date:** [April 12, 2018, 9:27am UTC](https://discuss.elastic.co/t/filebeat-vs-logstash/127485/38 "2018-04-12T09:27:06Z")
@sancroth here @jawad846 confirm that "done" means logstash is working ....??? ---
**Author:** ![jawad846](https://avatars.discourse-cdn.com/v4/letter/j/edb3f5/32.png) [@jawad846](https://discuss.elastic.co/u/jawad846)\ **Post date:** [April 12, 2018, 9:29am UTC](https://discuss.elastic.co/t/filebeat-vs-logstash/127485/39 "2018-04-12T09:29:35Z")
done, and restarted the logstash and run this command: bin/logstash -f /usr/share/logstash/logstash.conf ---
**Author:** ![harshbajaj16](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/harshbajaj16/32/44970_2.png) [@harshbajaj16](https://discuss.elastic.co/u/harshbajaj16)\ **Post date:** [April 12, 2018, 9:30am UTC](https://discuss.elastic.co/t/filebeat-vs-logstash/127485/40 "2018-04-12T09:30:25Z")
ohk now try to restart the filebeat and check. [Previous page](https://discuss.elastic.co/t/filebeat-vs-logstash/127485.md?page=1) [Next page](https://discuss.elastic.co/t/filebeat-vs-logstash/127485.md?page=3)