Issue when deployingin remote server as a docker image: logstastash log -> " Sending Logstash logs to /usr/share/logstash/logs which is now configured via log4j2.properties" - afterwards no logs from logstash

ERROR pipeline/output.go:100 Failed to connect to backoff(async(tcp://localhost:5044)): dial tcp [::1]:5044: connect: cannot assign requested address
2019-07-31T13:43:31.419Z INFO pipeline/output.go:93 Attempting to reconnect to backoff(async(tcp://localhost:5044)) with 60 reconnect attempt(s)

this is the filebeat log error

logstash is showing log like this for a long time.

Sending Logstash logs to /usr/share/logstash/logs which is now configured via log4j2.properties

but no progress after showing this message,

filebeat.yml file is like this

filebeat.inputs:
- type: docker
  combine_partial: true
  containers:
    path: "/usr/share/dockerlogs/data"
    stream: "stdout"
    close_inactive: 5m
    ids:
      - "*"
  exclude_files: ['\.gz$']
  ignore_older: 10m


output.logstash:
  enabled: true
  hosts: ["localhost:5044"]

logstash.conf file is like the folllowing

input { 
	beats {
	    port => 5044
	    host => "0.0.0.0"
	    ssl => false
  	}
}


filter {
  #If log line contains tab character followed by 'at' then we will tag that entry as stacktrace
  if [message] =~ "\tat" {
    grok {
      match => ["message", "^(\tat)"]
      add_tag => ["stacktrace"]
    }
  }

}

output { 

  stdout {
    codec => rubydebug
  }

  # Sending properly parsed log events to elasticsearch
  elasticsearch {
    hosts => ["192.168.99.100:9200"]
    index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
    document_type => "%{[@metadata][type]}"
  }
}

In local everything is working fine

When logstash is running what does 'netstat -an | grep -w 5044' show?

tcp6 0 0 :::5044 :::* LISTEN

I resolved the issue. It was in regards docker networking.

In logstash.conf i changed hosts => ["localhost:9200] to hosts => ["test-elasticsearch"]
in which test-elasticsearch is my container name.

elasticsearch {
    hosts => ["test-elasticsearch"]
    index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
    document_type => "%{[@metadata][type]}"
  }

Similarly i updated in filebeat.yml also - from hosts: ["localhost:5044"] to hosts: ["test-logstash"]

`output.logstash:
    enabled: true
    hosts: ["test-logstash"]`

Since the containers are in same network the changed host name worked for me.

Thanks for the response.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.