Http communication failure connection refused

Elastic Stack Logstash
1

Is there a way to keep the http port open in logstash?

2

Which an input plugin do you use? Have you put any restriction?

3

Hello Rios,

I am using http plugin in the input. I did not put any restriction.
I tried to use tcp_keep_alive => True but it did not worked as it is only applicable for tcp plugin.

4

You cannot use tcp_keep_alive as parameter. The HTTP connection should be always active when LS is up and running. Can you explain us:

  • how you set input plugin, full the input section
  • have you checked tcp/http connection by telner/curl to LS server
  • have you open the tcp port 80 on firewall
  • is there any trace in LS log
  • have you investigate in the debug mode:
    Add to the output section:
    stdout { codec => rubydebug{}}
5

What exactly you want to do?

If the Logstash service is running, the port on the http input will always be listening, if the port is not listening then the logstash service may be stopped.

What does your configuration looks like? You need to share it.

6

Hello Rios,

my input plugin is configured something like this.
input {
http {
port => "${port}"
host => "0.0.0.0"
codec => "json"
}
}

for bullet 1 and 2 i doubt i can do that since i have limited access as i am not the admin for the bullet 3 and 4 i will check that.

7

Hello leandro,

Thank you for your response, first is i just want to understand how http behaves in logstash. as you said if the logstash service is up and running. the port on the http will always be listening.

In your experience and experties in logstash do you have a known or common cause that affects the connection to http port except when the service is not running?

my logstash config look something like this.
input {
http {
port => "${port}"
host => "0.0.0.0"
codec => "json"
}
}

8

Make a test conf, something like this:

input {
	http {
		port => "1234"
		# host => "0.0.0.0" # No need, default value is "0.0.0.0"
		codec => "json"
	}
}
filter{
}
output {
    stdout { codec => rubydebug{}} 
}

Run LS, you should have active process on your port. Make sure that you have in the log, something like this:

2025-02-12T07:57:15,319][INFO ][logstash.javapipeline    ][ls] Pipeline started {"pipeline.id"=>"ls"}
[2025-02-12T07:57:15,320][INFO ][logstash.inputs.http     ][ls][d9dac642dfa1f391e1e5ff949cbd8cb61e85eb8f1b744e34a05132eb048783c8] Starting http input listener {:address=>"0.0.0.0:1234", :ssl_enabled=>false}

Send test data to LS, something like this:

curl -X POST http://localhost:1234/ -H "Content-Type: application/json" -d "{\"title\":\"The test\",\"author\":\"J.J. TEST\",\"sender\":\"devops\"}"

You should get parsed JSON fields.

In case of any issues please provide more details logs, screens.