How to configure filebeat and logstash? 3 VMs


(Mohamed) #1

Hello,
I have 3 VMs and I would like to install logstash locally and filebeat in each VM.
I installed filebeat and my filebeat.yml is

filebeat.prospectors:
- input_type: log
paths:
- /path/*.xml
# scan_frequency: 60s
document_type: message
multiline.pattern: '^<measInfo'
multiline.negate: true
multiline.match: after
output.logstash:
    hosts:["my_ip_address:5044"]

I did the same thing for 2 others VM
My logstash.conf (running locally) is:

input{
    beats{
    port=>5044
    host=>"ip_address_of_VM"
}}

I run logstash locally and then the filebeat in the VM1 but I get this message error:

Failed to connect: dial tcp my_ip_address:5044: getsockopt: connection refused

It's the correct way? and how I can resolve this problem? Thank you


(Peter Garlic) #2

Hi @saisimo02,
what operating system are you using on your vms?

Did you also check:

  1. firewall status
  2. listening ip/ports
  3. (if linux: selinux )

(Mohamed) #3

Hi It's working now I am using the local_IP also ( input logstash.conf).


(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.