Logstash error during setup

(Alpha Gamma) #1

Hi The team, I am getting error and tried many ways but dont know how to resolve below error.
In one of the previous blogs I found the logstash and elasticsearch should be on different VM, what if I want all on one one ubuntu machine.please help asap.

Failed to connect: Get http://localhost:5044: dial tcp getsockopt: connection refused

(Bryan Vest) #2

Can you scrub and post the network.host: section of your elasticsearch.yaml config? If this has been modified it may not be setup to answer on localhost.

Bryan Vest

(Alpha Gamma) #3

Hi Bryan ,you mean to say network.host:localhost should be in elasticsearch.yaml file.?or the same ip address whatever we give there

(Bryan Vest) #4

Whatever you have at network.host is where you have to connect. If you have
then you would have to

It does default to localhost if this option has not been modified.

(Alpha Gamma) #5

Thanks a lot but even doing this its not working some more setting I need to alter or check please comment

(Bryan Vest) #6

Multiple things could cause this. Since that did not seem to work the next step is to look at the elasticsearch.yml config file. You can DM it to me if you prefer but I can not go any further without taking a look at the config.

(Alpha Gamma) #7

please mention your email id

(Magnus Bäck) #8

Where, exactly, are you getting this error? Which configuration file contains "5044"?

(Alpha Gamma) #9

Hi Magnusbaeck ,thanks for joining conversation.It comes in /valor/log/filebeat where filebeat.1 filebeat.2 such files are generated .in those files it shows error

5044: getsockopt: connection refused

If anything need to do for open this port on ubuntu ,any commands required

I have defined this port in /etc/Logsatsh/conf.d/beats-input.conf

input {
beats {
port => 5400
type => "logs"
ssl => true
ssl_certificate => "/etc/pki/tls/certs/filebeat.crt"
ssl_key => "/etc/pki/tls/private/filebeat.key"

what else required what exactly i am missing.I would be grateful for resolving this issue

(Alpha Gamma) #10

Hi Bryan please ping email id again,earlier I was able to see not now

(Magnus Bäck) #11

Your Logstash configuration says 5400 and the Filebeat configuration appears to say 5044.

(Alpha Gamma) #12

Oh sorry it may be my editing both are 5044

(Alpha Gamma) #13

input {
beats {
port => 5044
type => "logs"
ssl => true
ssl_certificate => "/etc/pki/tls/certs/filebeat.crt"
ssl_key => "/etc/pki/tls/private/filebeat.key"

(Magnus Bäck) #14

Well, "connection refused" means that there was nobody listening on that port on that interface, or that a firewall is blocking the access. Double-check port numbers, use netstat to check which ports are being listened to, and verify the firewall status.

(Alpha Gamma) #15

Hi Magnus,
How can I use port 8080 if it is open.The port gets active when I start tomcat lets say I want to start 8080 without using tomcat .what is the command.

(Magnus Bäck) #16

Make sure Tomcat is shut down and doesn't start automatically, then change any 5044 port references to 8080.

(Alpha Gamma) #17

Yes Tomcat is surely shut down but then how to make 8080 working

(Magnus Bäck) #18

As I said, change any 5044 port references (in your configuration files) to 8080.

(system) #19

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.