# Logstash is not open 5044 port on ubuntu server

**URL:** <https://discuss.elastic.co/t/logstash-is-not-open-5044-port-on-ubuntu-server/85660>\
**Category:** Logstash\
**Created:** [May 14, 2017, 1:50am UTC](https://discuss.elastic.co/t/logstash-is-not-open-5044-port-on-ubuntu-server/85660 "2017-05-14T01:50:56Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![Fly](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fly/32/17992_2.png) [@Fly](https://discuss.elastic.co/u/Fly)\
**Post date:** [May 14, 2017, 1:50am UTC](https://discuss.elastic.co/t/logstash-is-not-open-5044-port-on-ubuntu-server/85660/1 "2017-05-14T01:50:56Z")

</div>

Hi all,  
I configured the pipeline to collect windows firewall log of windows server 2012 as follows:  
**etc/logstash/conf.d/10-input.conf**  
input {  
beats {  
# The port to listen on for filebeat connections.  
port =\> 5044  
}  
}  
**etc/logstash/conf.d/20-fwlog.conf**

filter {  
grok {  
match =\> { "message" =\> "%{TIMESTAMP\_ISO8601:date\_time} %{DATA:action} %{WORD:protocol} %{IPORHOST:src\_ip} %{IPORHOST:dst\_ip} %{INT:src\_port} %{INT:dst\_port} %{DATA:size} %{DATA:tcp\_flags} %{DATA:tcp\_syn} %{DATA:tcp\_act} %{DATA:tcp\_win} %{DATA:acmp\_type} ${DATA:icmp\_code} %{DATA:info} %{WORD:path}"}  
}  
date {  
match =\> ["timestamp" , "dd/MMM/yyyy:HH:mm:ss Z"]  
}  
}  
**etc/logstash/conf.d/30-output.conf**

output {  
elasticsearch {  
hosts =\> ["localhost:9200"]  
sniffing =\> true  
manage\_template =\> false  
index =\> "%{[@metadata][beat]}-%{+YYYY.MM.dd}"  
document\_type =\> "%{[@metadata][type]}"  
}  
}  
Until I run the **netstat -lntp** command. Did not see it active port 5044 ☹

 ![](https://us1.discourse-cdn.com/elastic/original/3X/3/2/323d5686d09675dd9b163514624e1f3cc1f31b4c.png)

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [May 14, 2017, 8:11pm UTC](https://discuss.elastic.co/t/logstash-is-not-open-5044-port-on-ubuntu-server/85660/2 "2017-05-14T20:11:54Z")

</div>

Please don't post pictures of text, they are difficult to read and some people may not be even able to see them.

Has LS started? Can you try telnetting to the port?

---

<div class="post-metadata">

**Author:** ![Fly](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fly/32/17992_2.png) [@Fly](https://discuss.elastic.co/u/Fly)\
**Post date:** [May 15, 2017, 12:23am UTC](https://discuss.elastic.co/t/logstash-is-not-open-5044-port-on-ubuntu-server/85660/3 "2017-05-15T00:23:13Z")

</div>

HI warkolm,  
Thanks for answering.  
Yes, I will draw on the experience for the next post.  
I tried telnet from windows machine to LS under port 5044 but failed.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [May 15, 2017, 12:36am UTC](https://discuss.elastic.co/t/logstash-is-not-open-5044-port-on-ubuntu-server/85660/4 "2017-05-15T00:36:26Z")

</div>

> [@Fly](#):
>
> I tried telnet from windows machine to LS under port 5044 but failed.

Failed how?

---

<div class="post-metadata">

**Author:** ![Fly](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fly/32/17992_2.png) [@Fly](https://discuss.elastic.co/u/Fly)\
**Post date:** [May 15, 2017, 12:48am UTC](https://discuss.elastic.co/t/logstash-is-not-open-5044-port-on-ubuntu-server/85660/5 "2017-05-15T00:48:35Z")

</div>

When I try test telnet to LS, the following message appears:  
PingSuccessed : true  
TcpTestSuccessed : False

---

<div class="post-metadata">

**Author:** ![Fly](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fly/32/17992_2.png) [@Fly](https://discuss.elastic.co/u/Fly)\
**Post date:** [May 15, 2017, 12:54am UTC](https://discuss.elastic.co/t/logstash-is-not-open-5044-port-on-ubuntu-server/85660/6 "2017-05-15T00:54:07Z")

</div>

On LS I run **sudo service logstash configtest** command to see the message  
LS Unrecognized service

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [May 15, 2017, 12:54am UTC](https://discuss.elastic.co/t/logstash-is-not-open-5044-port-on-ubuntu-server/85660/7 "2017-05-15T00:54:54Z")

</div>

Can you please show the full command and output that you are running.

---

<div class="post-metadata">

**Author:** ![Fly](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fly/32/17992_2.png) [@Fly](https://discuss.elastic.co/u/Fly)\
**Post date:** [May 15, 2017, 1:03am UTC](https://discuss.elastic.co/t/logstash-is-not-open-5044-port-on-ubuntu-server/85660/8 "2017-05-15T01:03:21Z")

</div>

C:\Windows\system32\> Test-NetConnection -Port 5044  
WARING: TCP connect to \< IP of LS\>:5044 failed

ComputerName : IP  
RemoteAddress : IP  
RemotePort : 5044  
InterfaceAlias : Eth0  
SourceAddress :   
PingSuccessed : true  
TcpTestSuccessed : False

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 12, 2017, 1:13am UTC](https://discuss.elastic.co/t/logstash-is-not-open-5044-port-on-ubuntu-server/85660/9 "2017-06-12T01:13:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.