I am trying to get logstash listening on 3515 and 514 so I can ship logs from my Windows client and Bro sensor. I am using CentOS 6.6. Any thoughts be awesome. I've been working on this for a few days.
Things I have done:
- verified the system isn't listening using netstat -antup and netstat -ano
- restarted ELK services
- used netcat and see it open the port
- Totally disabled iptables
- disabled selinux
- Checked Nxlog on windows system and it lists the below
2015-07-12 23:20:36 INFO connecting to 188.8.131.52:3515
2015-07-12 23:20:57 INFO reconnecting in 32 seconds
2015-07-12 23:20:57 ERROR couldn't connect to tcp socket on 184.108.40.206:3515; A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond.
- rechecked my config files in /etc/logstash/conf.d. Below are the input files. They are saved as separate files
3515 conf file
type => "WindowsEventLog"
port => "3515"
format => "json"
tags => [ "Windows" ]
514 conf file
type => "syslog"
port => "514"