Logstash error during setup

Elastic Stack Logstash
1

Hi The team, I am getting error and tried many ways but dont know how to resolve below error.
In one of the previous blogs I found the logstash and elasticsearch should be on different VM, what if I want all on one one ubuntu machine.please help asap.

Failed to connect: Get http://localhost:5044: dial tcp 127.0.0.1:5044: getsockopt: connection refused

2

Can you scrub and post the network.host: section of your elasticsearch.yaml config? If this has been modified it may not be setup to answer on localhost.

Bryan Vest

3

Hi Bryan ,you mean to say network.host:localhost should be in elasticsearch.yaml file.?or the same ip address whatever we give there

4

Whatever you have at network.host is where you have to connect. If you have
network.host: 10.10.10.10
then you would have to http://10.10.10.10:5044

It does default to localhost if this option has not been modified.

5

Thanks a lot but even doing this its not working some more setting I need to alter or check please comment

6

Multiple things could cause this. Since that did not seem to work the next step is to look at the elasticsearch.yml config file. You can DM it to me if you prefer but I can not go any further without taking a look at the config.

7

please mention your email id

8

Where, exactly, are you getting this error? Which configuration file contains "5044"?

9

Hi Magnusbaeck ,thanks for joining conversation.It comes in /valor/log/filebeat where filebeat.1 filebeat.2 such files are generated .in those files it shows error

5044: getsockopt: connection refused

If anything need to do for open this port on ubuntu ,any commands required

I have defined this port in /etc/Logsatsh/conf.d/beats-input.conf

input {
beats {
port => 5400
type => "logs"
ssl => true
ssl_certificate => "/etc/pki/tls/certs/filebeat.crt"
ssl_key => "/etc/pki/tls/private/filebeat.key"
}
}

what else required what exactly i am missing.I would be grateful for resolving this issue

10

Hi Bryan please ping email id again,earlier I was able to see not now

11

Your Logstash configuration says 5400 and the Filebeat configuration appears to say 5044.

12

Oh sorry it may be my editing both are 5044

13

input {
beats {
port => 5044
type => "logs"
ssl => true
ssl_certificate => "/etc/pki/tls/certs/filebeat.crt"
ssl_key => "/etc/pki/tls/private/filebeat.key"
}
}

14

Well, "connection refused" means that there was nobody listening on that port on that interface, or that a firewall is blocking the access. Double-check port numbers, use netstat to check which ports are being listened to, and verify the firewall status.

15

Hi Magnus,
How can I use port 8080 if it is open.The port gets active when I start tomcat lets say I want to start 8080 without using tomcat .what is the command.

16

Make sure Tomcat is shut down and doesn't start automatically, then change any 5044 port references to 8080.

17

Yes Tomcat is surely shut down but then how to make 8080 working

18

As I said, change any 5044 port references (in your configuration files) to 8080.

19

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.