# Logstash Forwarder connection refused in docker container **URL:** \ **Category:** Logstash\ **Created:** [September 16, 2015, 8:21pm UTC](https://discuss.elastic.co/t/logstash-forwarder-connection-refused-in-docker-container/29440 "2015-09-16T20:21:38Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![kmroz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kmroz/32/62741_2.png) [@kmroz](https://discuss.elastic.co/u/kmroz)\ **Post date:** [September 16, 2015, 8:21pm UTC](https://discuss.elastic.co/t/logstash-forwarder-connection-refused-in-docker-container/29440/1 "2015-09-16T20:21:38Z")
Hello , i seem to follow the same rules on setting up the forwarder but it seems every time i run it i get a connection refused. The IP match as the same in the logstash conf file. I have also passed along the certs to the host name. Any help on this would be great! thanks, ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [September 17, 2015, 3:45am UTC](https://discuss.elastic.co/t/logstash-forwarder-connection-refused-in-docker-container/29440/2 "2015-09-17T03:45:21Z")
We need more details about your setup, both the logstash-forwarder configuration and the container structure. ---
**Author:** ![kmroz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kmroz/32/62741_2.png) [@kmroz](https://discuss.elastic.co/u/kmroz)\ **Post date:** [September 17, 2015, 1:58pm UTC](https://discuss.elastic.co/t/logstash-forwarder-connection-refused-in-docker-container/29440/3 "2015-09-17T13:58:29Z")
My docker setup is grabbed from [https://github.com/spujadas/elk-docker/blob/master/Dockerfile](https://github.com/spujadas/elk-docker/blob/master/Dockerfile) except i made minor changes to make it work for CentOS... my logstash forwarder is setup as follows network": { "servers": ["(host that i want to get logs from..same as in logstash.conf:5000"], ``` "timeout": 15, "ssl ca": "/etc/certs/logstash-forwarder.crt" ``` }, "files": [ { ``` "fields": { "type": "syslog" } } ``` ] } ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [September 17, 2015, 2:05pm UTC](https://discuss.elastic.co/t/logstash-forwarder-connection-refused-in-docker-container/29440/4 "2015-09-17T14:05:45Z")
So, just to be clear: The `servers` array in the LSF configuration uses the IP address or hostname of the Docker container that runs Logstash? ---
**Author:** ![kmroz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kmroz/32/62741_2.png) [@kmroz](https://discuss.elastic.co/u/kmroz)\ **Post date:** [September 17, 2015, 2:37pm UTC](https://discuss.elastic.co/t/logstash-forwarder-connection-refused-in-docker-container/29440/5 "2015-09-17T14:37:27Z")
No , i want to grab the logs from a remote host, So i have it set as the IP of that remote host not the docker container. ---
**Author:** ![kmroz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kmroz/32/62741_2.png) [@kmroz](https://discuss.elastic.co/u/kmroz)\ **Post date:** [September 17, 2015, 4:00pm UTC](https://discuss.elastic.co/t/logstash-forwarder-connection-refused-in-docker-container/29440/6 "2015-09-17T16:00:56Z")
So after trying this out with out sing docker i may have figure out the problem. It had to do with the certs. I read the issue about using the ssl certs but i'm confused. If i want to have logstash forwarder grab logs from more than one host how do I go about doing that if I need to specify the IP i want the cert to be pointing at? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [September 17, 2015, 4:02pm UTC](https://discuss.elastic.co/t/logstash-forwarder-connection-refused-in-docker-container/29440/7 "2015-09-17T16:02:38Z")
Maybe we're talking past each other here, but it seems like you're misunderstanding what logstash-forwarder does. It doesn't pull log messages from remote machines. It reads locally accessible files and pushes them to other servers (often a server running Logstash and Elasticsearch). ---
**Author:** ![kmroz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kmroz/32/62741_2.png) [@kmroz](https://discuss.elastic.co/u/kmroz)\ **Post date:** [September 17, 2015, 4:06pm UTC](https://discuss.elastic.co/t/logstash-forwarder-connection-refused-in-docker-container/29440/8 "2015-09-17T16:06:06Z")
So how I have it setup now is I ahve the ELK stack( with the forwarder on Host A and i want to read the logs from Hosts C,D,E. How would i have to set the forwarder up ? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [September 17, 2015, 5:25pm UTC](https://discuss.elastic.co/t/logstash-forwarder-connection-refused-in-docker-container/29440/9 "2015-09-17T17:25:36Z")
You would run logstash-forwarder on hosts C, D, and E and have it send the logs you're interested in on each host to host A (if that's where you're running Logstash). ---
**Author:** ![kmroz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kmroz/32/62741_2.png) [@kmroz](https://discuss.elastic.co/u/kmroz)\ **Post date:** [September 17, 2015, 6:11pm UTC](https://discuss.elastic.co/t/logstash-forwarder-connection-refused-in-docker-container/29440/10 "2015-09-17T18:11:13Z")
So i have that setup like that.. Where the certs are passed and forwarder on boxes C,D,E all are pointing to host A. but still no logs showing from the other hosts. ---
**Author:** ![kmroz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kmroz/32/62741_2.png) [@kmroz](https://discuss.elastic.co/u/kmroz)\ **Post date:** [September 17, 2015, 6:39pm UTC](https://discuss.elastic.co/t/logstash-forwarder-connection-refused-in-docker-container/29440/12 "2015-09-17T18:39:59Z")
So new error, I can see the logs in Kibana but it is showing failed tls handshake.. which is what is showing in the forwarder logs on that remote host. ---
**Author:** ![kmroz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kmroz/32/62741_2.png) [@kmroz](https://discuss.elastic.co/u/kmroz)\ **Post date:** [September 18, 2015, 3:04pm UTC](https://discuss.elastic.co/t/logstash-forwarder-connection-refused-in-docker-container/29440/13 "2015-09-18T15:04:48Z")
Can you please show me an example of how the forwarder should be setup in my situation. i feel i'm still not understanding it completely. I want the logs from host C.D.E and send them all to host A where i have elasticsearch,kibana,logstash, and the forwarder installed. The forwarder is installed on hosts C,D,and E also. How should the forwarder be setup on host A and remote hosts? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [September 19, 2015, 5:14pm UTC](https://discuss.elastic.co/t/logstash-forwarder-connection-refused-in-docker-container/29440/14 "2015-09-19T17:14:22Z")
I can't help with the TLS handshake problems. You don't need logstash-forwarder on host A since you're running Logstash there. Logstash can do everything that logstash-forwarder can do and then some. It would help if you'd present your current configuration and the exact error message you get. Copy and paste the relevant log messages. ---
**Author:** ![kmroz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kmroz/32/62741_2.png) [@kmroz](https://discuss.elastic.co/u/kmroz)\ **Post date:** [September 21, 2015, 2:41pm UTC](https://discuss.elastic.co/t/logstash-forwarder-connection-refused-in-docker-container/29440/15 "2015-09-21T14:41:33Z")
logstash-forwarder config: { "network": { "servers": ["IP:5000"], "timeout": 15, "ssl ca": "/etc/certs/logstash-forwarder.crt" }, "files": [ { "paths": [ "/var/log/puppet/puppet.log" ], "fields": { "type": "puppet" } } ] } input { lumberjack { port =\> 5000 type =\> "logs" ssl\_certificate =\> "/etc/certs/logstash-forwarder.crt" ssl\_key =\> "/etc/private/logstash-forwarder.key" } } filter { if [type] == "puppet" { grok { break\_on\_match =\> false match =\> { "message"=\>"%{GREEDYDATA:logs}"} output { elasticsearch { host =\> localhost } stdout { codec =\> rubydebug } } ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [September 21, 2015, 2:44pm UTC](https://discuss.elastic.co/t/logstash-forwarder-connection-refused-in-docker-container/29440/16 "2015-09-21T14:44:55Z")
The Logstash configuration snippet as posted is missing at least a couple of closing braces. Is this actually the configuration you're using? ---
**Author:** ![kmroz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kmroz/32/62741_2.png) [@kmroz](https://discuss.elastic.co/u/kmroz)\ **Post date:** [September 21, 2015, 2:51pm UTC](https://discuss.elastic.co/t/logstash-forwarder-connection-refused-in-docker-container/29440/17 "2015-09-21T14:51:38Z")
the brackets are there. I am able to do the handhsake now per stopping forwarder on host A. Now the only issue is that the logs are not coming in. they are two days behind. ---
**Author:** ![kmroz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kmroz/32/62741_2.png) [@kmroz](https://discuss.elastic.co/u/kmroz)\ **Post date:** [September 21, 2015, 2:55pm UTC](https://discuss.elastic.co/t/logstash-forwarder-connection-refused-in-docker-container/29440/18 "2015-09-21T14:55:40Z")
{:timestamp=\>"2015-09-21T14:48:49.450000+0000", :message=\>"The error reported is : \n Address already in use - bind - Address already in use"} current error in logstash log ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [September 21, 2015, 2:59pm UTC](https://discuss.elastic.co/t/logstash-forwarder-connection-refused-in-docker-container/29440/19 "2015-09-21T14:59:35Z")
You can only have one process listening on port 5000 at any given time. Perhaps you have two Logstash processes running? ---
**Author:** ![kmroz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kmroz/32/62741_2.png) [@kmroz](https://discuss.elastic.co/u/kmroz)\ **Post date:** [September 21, 2015, 3:18pm UTC](https://discuss.elastic.co/t/logstash-forwarder-connection-refused-in-docker-container/29440/20 "2015-09-21T15:18:46Z")
i only have one intance running on this box. I killed the PID of all applications and restarted them and still get the same error. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [September 21, 2015, 4:32pm UTC](https://discuss.elastic.co/t/logstash-forwarder-connection-refused-in-docker-container/29440/21 "2015-09-21T16:32:04Z")
You can use lsof to check which process is keeping a port open (e.g. `sudo lsof -i :5000`). I suggest you carefully examine _all_ files in /etc/logstash/conf.d as I suspect you have a backup file or similar that contains the extra input declaration. Logstash will read _all_ files in that directory. [Next page](https://discuss.elastic.co/t/logstash-forwarder-connection-refused-in-docker-container/29440.md?page=2)