# Filebeeat sending log, but logstash not running, connection refused!

**URL:** <https://discuss.elastic.co/t/filebeeat-sending-log-but-logstash-not-running-connection-refused/116665>\
**Category:** Logstash\
**Created:** [January 23, 2018, 12:38pm UTC](https://discuss.elastic.co/t/filebeeat-sending-log-but-logstash-not-running-connection-refused/116665 "2018-01-23T12:38:23Z")\
**Posts on this page:** 12\
**Page:** 1

<div class="post-metadata">

**Author:** ![omid](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/omid/32/33595_2.png) [@omid](https://discuss.elastic.co/u/omid)\
**Post date:** [January 23, 2018, 12:38pm UTC](https://discuss.elastic.co/t/filebeeat-sending-log-but-logstash-not-running-connection-refused/116665/1 "2018-01-23T12:38:23Z")

</div>

hi  
im used filebeat to many server, shipped nginx log to logstash  
in this time and months my elk server is very good worked  
but, my 1 line added grok pattern to syslog-filter.conf, and restart logstash ,,,  
my elk and Concerning Logstash not worked  
this is wehn, my elasticsearch and logatash and kibana ... services this up and enable and active!  
but ...  
my nginx servers ...  
telnet to 5044  
and  
telnet to 5443  
connection refused

this log, 1 server Logs (filebeat logs)

> ```
> > 2018-01-23T10:21:21+03:30 ERR Failed to connect: dial tcp 172.17.11.202:5443: getsockopt: connection refused
> > 2018-01-23T10:21:28+03:30 INFO Non-zero metrics in the last 30s: beat.memstats.gc_next=11769216 beat.memstats.memory_alloc=5935656 beat.memstats.memory_total=73881024 filebeat.harvester.open_files=5 filebeat.harvester.running=6 libbeat.config.module.running=0 libbeat.pipeline.clients=1 libbeat.pipeline.events.active=4117 libbeat.pipeline.events.retry=2048 registrar.states.current=35
> > 2018-01-23T10:47:16+03:30 INFO Non-zero metrics in the last 30s: beat.memstats.gc_next=11297792 beat.memstats.memory_alloc=5872352 beat.memstats.memory_total=26557112 filebeat.harvester.open_files=5 filebeat.harvester.running=6 libbeat.config.module.running=0 libbeat.pipeline.clients=1 libbeat.pipeline.events.active=4117 registrar.states.current=37
> > 2018-01-23T10:47:22+03:30 ERR Failed to connect: dial tcp 172.17.11.202:5443: getsockopt: connection refused
> > 2018-01-23T10:47:46+03:30 INFO Non-zero metrics in the last 30s: beat.memstats.gc_next=11297792 beat.memstats.memory_alloc=6012704 beat.memstats.memory_total=26697464 filebeat.harvester.open_files=5 filebeat.harvester.running=6 libbeat.config.module.running=0 libbeat.pipeline.clients=1 libbeat.pipeline.events.active=4117 libbeat.pipeline.events.retry=2048 registrar.states.current=37
> > 2018-01-23T14:22:45+03:30 INFO Non-zero metrics in the last 30s: beat.info.uptime.ms=30000 beat.memstats.gc_next=11490800 beat.memstats.memory_alloc=5802160 beat.memstats.memory_total=153496216 filebeat.harvester.open_files=3 filebeat.harvester.running=2 libbeat.config.module.running=0 libbeat.pipeline.clients=1 libbeat.pipeline.events.active=4117 registrar.states.current=3
> 
> ```

---

<div class="post-metadata">

**Author:** ![lauea](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lauea/32/26743_2.png) [@lauea](https://discuss.elastic.co/u/lauea)\
**Post date:** [January 23, 2018, 3:51pm UTC](https://discuss.elastic.co/t/filebeeat-sending-log-but-logstash-not-running-connection-refused/116665/2 "2018-01-23T15:51:54Z")

</div>

Maybe more log information for `Logstash` is useful for community.😀

---

<div class="post-metadata">

**Author:** ![omid](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/omid/32/33595_2.png) [@omid](https://discuss.elastic.co/u/omid)\
**Post date:** [January 24, 2018, 7:11am UTC](https://discuss.elastic.co/t/filebeeat-sending-log-but-logstash-not-running-connection-refused/116665/3 "2018-01-24T07:11:29Z")

</div>

Which logstash information do I give?

---

<div class="post-metadata">

**Author:** ![lauea](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lauea/32/26743_2.png) [@lauea](https://discuss.elastic.co/u/lauea)\
**Post date:** [January 24, 2018, 7:14am UTC](https://discuss.elastic.co/t/filebeeat-sending-log-but-logstash-not-running-connection-refused/116665/4 "2018-01-24T07:14:59Z")

</div>

You need to confirm your logstash service is up.

But per your filebeat log, `connection refused` should represent `logstash` is inactivate.

---

<div class="post-metadata">

**Author:** ![omid](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/omid/32/33595_2.png) [@omid](https://discuss.elastic.co/u/omid)\
**Post date:** [January 24, 2018, 7:35am UTC](https://discuss.elastic.co/t/filebeeat-sending-log-but-logstash-not-running-connection-refused/116665/5 "2018-01-24T07:35:15Z")

</div>

```
[2018-01-24T10:42:41,061][INFO][logstash.runner] Starting Logstash {"logstash.version"=>"6.1.0"}
[2018-01-24T10:42:41,260][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=>9600}
[2018-01-24T10:42:41,390][ERROR][logstash.agent] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of #, \", ', -, [, { at line 18, column 7 (byte 1393) after filter {\n grok {\n match => { message => [\n \"%{IP:client} %{HTTPDUSER:ident} %{USER:auth} \\[%{HTTPDATE:timestamp_server_genaration}\\] \\\"%{WORD:method} %{URIPATHPARAM:request} HTTP/%{NUMBER:httpversion}\\\" %{NUMBER:status_code} %{NUMBER:bytes} %{QS:refferer} %{QS:user_agent} length %{NUMBER:length} rtime %{NUMBER:request_time} uri %{URIPATHPARAM:uri} realip %{IP:realip}\",\n \"%{IP:client} %{HTTPDUSER:ident} %{USER:auth} \\[%{HTTPDATE:timestamp_server_genaration}\\] \\\"%{WORD:method} %{URIPATHPARAM:request} HTTP/%{NUMBER:httpversion}\\\" %{NUMBER:status_code} %{NUMBER:bytes} %{QS:refferer} %{QS:user_agent} length %{NUMBER:length} rtime %{NUMBER:request_time} uri %{URIPATHPARAM:uri}\",\n \"(?<timestamp>%{YEAR}[./]%{MONTHNUM}[./]%{MONTHDAY} %{TIME}) \\[%{LOGLEVEL:severity}\\] %{POSINT:pid}#%{NUMBER:threadid}\\: \\*%{NUMBER:connectionid} %{GREEDYDATA:errormessage}, client: %{IP:client}, server: %{GREEDYDATA:server}, request: %{GREEDYDATA:request}\",\n \"%{IP:client} %{HTTPDUSER:ident} %{USER:auth} \\[%{HTTPDATE:timestamp_server_genaration}\\] \\\"%{WORD:method} %{URIPATHPARAM:request} HTTP/%{NUMBER:httpversion}\\\" %{NUMBER:status_code} %{NUMBER:bytes} %{QS:refferer} %{QS:user_agent}\",\n ", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:42:in `compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:50:in `compile_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:12:in `block in compile_sources'", "org/jruby/RubyArray.java:2486:in `map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in `compile_sources'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:51:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:171:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:40:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:335:in `block in converge_state'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:141:in `with_pipelines'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:332:in `block in converge_state'", "org/jruby/RubyArray.java:1734:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:319:in `converge_state'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:166:in `block in converge_state_and_update'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:141:in `with_pipelines'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:164:in `converge_state_and_update'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:90:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:343:in `block in execute'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/stud-0.0.23/lib/stud/task.rb:24:in `block in initialize'"]}
[2018-01-24T10:42:54,443][INFO][logstash.modules.scaffold] Initializing module {:module_name=>"netflow", :directory=>"/usr/share/logstash/modules/netflow/configuration"}
[2018-01-24T10:42:54,446][INFO][logstash.modules.scaffold] Initializing module {:module_name=>"fb_apache", :directory=>"/usr/share/logstash/modules/fb_apache/configuration"}
[2018-01-24T10:42:54,750][WARN][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified

```

this log logstash log  
my logstash service is fully up  
but no listen port 5443 or 5044 !!!

---

<div class="post-metadata">

**Author:** ![lauea](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lauea/32/26743_2.png) [@lauea](https://discuss.elastic.co/u/lauea)\
**Post date:** [January 24, 2018, 7:36am UTC](https://discuss.elastic.co/t/filebeeat-sending-log-but-logstash-not-running-connection-refused/116665/6 "2018-01-24T07:36:32Z")

</div>

No. Configuration error.

> [2018-01-24T10:42:41,390][ERROR][logstash.agent] Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"LogStash::ConfigurationError", :message=\>"Expected one of #, ", ', -, [, { at line 18, column 7 (byte 1393) after filter {\n grok {\n match =\> { message =\> [\n "%{IP:client} %{HTTPDUSER:ident} %{USER:auth} \[%{HTTPDATE:timestamp\_server\_genaration}\] \"%{WORD:method} %{URIPATHPARAM:request} HTTP/%{NUMBER:httpversion}\" %{NUMBER:status\_code} %{NUMBER:bytes} %{QS:refferer} %{QS:user\_agent} length %{NUMBER:length} rtime %{NUMBER:request\_time} uri %{URIPATHPARAM:uri} realip %{IP:realip}",\n "%{IP:client} %{HTTPDUSER:ident} %{USER:auth} \[%{HTTPDATE:timestamp\_server\_genaration}\] \"%{WORD:method} %{URIPATHPARAM:request} HTTP/%{NUMBER:httpversion}\" %{NUMBER:status\_code} %{NUMBER:bytes} %{QS:refferer} %{QS:user\_agent} length %{NUMBER:length} rtime %{NUMBER:request\_time} uri %{URIPATHPARAM:uri}",\n "(?%{YEAR}[./]%{MONTHNUM}[./]%{MONTHDAY} %{TIME}) \[%{LOGLEVEL:severity}\] %{POSINT:pid}#%{NUMBER:threadid}\: \*%{NUMBER:connectionid} %{GREEDYDATA:errormessage}, client: %{IP:client}, server: %{GREEDYDATA:server}, request: %{GREEDYDATA:request}",\n "%{IP:client} %{HTTPDUSER:ident} %{USER:auth} \[%{HTTPDATE:timestamp\_server\_genaration}\] \"%{WORD:method} %{URIPATHPARAM:request} HTTP/%{NUMBER:httpversion}\" %{NUMBER:status\_code} %{NUMBER:bytes} %{QS:refferer} %{QS:user\_agent}",\n ", :backtrace=\>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:42:in `compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:50:in `compile\_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:12:in `block in compile_sources'", "org/jruby/RubyArray.java:2486:in `map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in `compile_sources'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:51:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:171:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:40:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:335:in `block in converge_state'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:141:in `with\_pipelines'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:332:in `block in converge_state'", "org/jruby/RubyArray.java:1734:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:319:in `converge_state'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:166:in `block in converge\_state\_and\_update'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:141:in `with_pipelines'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:164:in `converge\_state\_and\_update'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:90:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:343:in `block in execute'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/stud-0.0.23/lib/stud/task.rb:24:in `block in initialize'"]}

---

<div class="post-metadata">

**Author:** ![omid](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/omid/32/33595_2.png) [@omid](https://discuss.elastic.co/u/omid)\
**Post date:** [January 24, 2018, 7:38am UTC](https://discuss.elastic.co/t/filebeeat-sending-log-but-logstash-not-running-connection-refused/116665/7 "2018-01-24T07:38:57Z")

</div>

im elk services, During this time he worked without problems  
im added 1 line grok pattern, logstash DOWN!  
why ?

---

<div class="post-metadata">

**Author:** ![lauea](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lauea/32/26743_2.png) [@lauea](https://discuss.elastic.co/u/lauea)\
**Post date:** [January 24, 2018, 7:42am UTC](https://discuss.elastic.co/t/filebeeat-sending-log-but-logstash-not-running-connection-refused/116665/8 "2018-01-24T07:42:05Z")

</div>

Logstash receives message from filebeat while send format json to es. Kibana will load data from es. So even you see kibana/es working, not demonstrate logstash working.  
You need to check config of logstash.

---

<div class="post-metadata">

**Author:** ![omid](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/omid/32/33595_2.png) [@omid](https://discuss.elastic.co/u/omid)\
**Post date:** [January 24, 2018, 7:43am UTC](https://discuss.elastic.co/t/filebeeat-sending-log-but-logstash-not-running-connection-refused/116665/9 "2018-01-24T07:43:35Z")

</div>

Thnks,  
im checked **logstash.yml** or Inside the folder **conf.d**??

---

<div class="post-metadata">

**Author:** ![omid](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/omid/32/33595_2.png) [@omid](https://discuss.elastic.co/u/omid)\
**Post date:** [January 24, 2018, 8:15am UTC](https://discuss.elastic.co/t/filebeeat-sending-log-but-logstash-not-running-connection-refused/116665/10 "2018-01-24T08:15:30Z")

</div>

Thanks Thanks  
im finding to problem ...  
Inside the folder conf.d ...  
my grok pattern ... conflicted  
2 grok conflicted .  
deleted last lined added, fix .

---

<div class="post-metadata">

**Author:** ![lauea](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lauea/32/26743_2.png) [@lauea](https://discuss.elastic.co/u/lauea)\
**Post date:** [January 24, 2018, 2:10pm UTC](https://discuss.elastic.co/t/filebeeat-sending-log-but-logstash-not-running-connection-refused/116665/11 "2018-01-24T14:10:20Z")

</div>

Good job.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 21, 2018, 2:10pm UTC](https://discuss.elastic.co/t/filebeeat-sending-log-but-logstash-not-running-connection-refused/116665/12 "2018-02-21T14:10:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.