Logstash keep restarting and doesn't listen to beats

Hi guys, i'm using ubuntu server 16.10 headless, i installed ELK and filebeat via apt,
configured everything i should've (that i know of) and for some reason, logstash isn't getting the syslogs from the 'filebeat' , and the logstash service keeps shutting down and activating again and again.
i realy dont get what's happening and would like some help.
•note: every think is installed on a single machine who's IP is
here are my config file:
logstash conf:
`input {
beats {
port => "5043"

filter {

if [type] == "syslog" {
grok {
match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostnmae} %{DATA:syslog_program}(?:[%{POSINT:syslog_pid}])?: %{GREEDYDATA:syslog_message}" }

output {
hosts => [""]
index => "%{[@metadata][beats]}-%{+YYYY.MM.dd}"
docuent_type => "%{[@metadata][type]}"

filebeat conf:
#-------------------------- Elasticsearch output ------------------------------

Array of hosts to connect to.

#hosts: ["localhost:9200"]

Optional protocol and basic auth credentials.

#protocol: "https"
#username: "elastic"
#password: "changeme"

#----------------------------- Logstash output --------------------------------

The Logstash hosts

hosts: [""]

If Logstash is restarting I'd expect to find clues in the Logstash log.

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.