Logstash cant receive log from filebeat

Elastic Stack Beats
1

I'm using filebeat-6.2.3 ,logstash-6.2.2
filebeat config：

filebeat.prospectors:
- type: log
   paths:
    - /path/to/file/log/*.log
output.logstash:
  # The Logstash hosts
  hosts: ["192.168.15.41:5044"]
  enabled: true

logstash:

input {
        beats{
             port=>5044}
}
output{
        stdout { codec => rubydebug }
}

I run the command filebeat ,logstash didn't print the log on stdout.

logstash's console like this:

[2018-03-22T14:57:23,959][INFO ][logstash.inputs.beats    ] Beats inputs: Starting input listener {:address=>"0.0.0.0:5044"}
[2018-03-22T14:57:24,015][INFO ][logstash.pipeline        ] Pipeline started succesfully {:pipeline_id=>"main", :thread=>"#<Thread:0x6df34d4d sleep>"}
[2018-03-22T14:57:24,051][INFO ][org.logstash.beats.Server] Starting server on port: 5044
[2018-03-22T14:57:24,078][INFO ][logstash.agent           ] Pipelines running {:count=>1, :pipelines=>["main"]}

For testing,I changed the filebeat's config "output.logstash" into output.file ,the test file can be built with log content.

config like this:

#output.file:
#  path: "/tmp/filebeat"
#  filename: filebeat
#  enabled: true

I wonder how I confirm filebeat has communicated with logstash.
Why the logstash can't receive the log .
Thanks a lot!

2

You can run filebeat test output.

3

Thank you for reply.
I run the command,there is a WARN:

logstash: 192.168.15.41:5044...
  connection...
    parse host... OK
    dns lookup... OK
    addresses: 192.168.15.41
    dial up... OK
  TLS... WARN secure connection disabled
  talk to server... OK

Is there something wrong?
What do I need to do? My logstash didn't install x-pach,but my elasticsearch did.
Thanks a lot!

4

I know what's the matter with my filebeat.
For some reasons,at first I run the filebeat and harvested the log into output.file,after that I run the logstash.
logstash don't receive the old log.
So,I stop filebeat and delete the registry file,then It works,logstash can receive the logs.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.