# Logstash not binding to 5504

**URL:** <https://discuss.elastic.co/t/logstash-not-binding-to-5504/37166>\
**Category:** Logstash\
**Created:** [December 14, 2015, 8:49pm UTC](https://discuss.elastic.co/t/logstash-not-binding-to-5504/37166 "2015-12-14T20:49:03Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![jacoblw](https://avatars.discourse-cdn.com/v4/letter/j/c68b51/32.png) [@jacoblw](https://discuss.elastic.co/u/jacoblw)\
**Post date:** [December 14, 2015, 8:49pm UTC](https://discuss.elastic.co/t/logstash-not-binding-to-5504/37166/1 "2015-12-14T20:49:03Z")

</div>

Hi,

I'm new to the ELK stack. Following the guide for CentOS 7 created by [DigitalOcean](https://www.digitalocean.com/community/tutorials/how-to-install-elasticsearch-logstash-and-kibana-elk-stack-on-centos-7)

I got as far as creating an index pattern in Kibana before I noticed I was running into an issue.

I get the following error in /var/log/logstash/logstash.log

```
{:timestamp=>"2015-12-14T20:14:02.545000+0000", :message=>"Connection refused", :class=>"Manticore::SocketException", :level=>:error}

```

The following returns nothing;

```
[root@elk ~]# netstat | grep 5044
[root@elk ~]# netstat | grep logstash

```

This is my 02-filebeat-input.conf

```
input {
    beats {
    port => 5044
    type => "logs"
    ssl => true
    ssl_certificate => "/etc/pki/tls/certs/logstash-forwarder.crt"
    ssl_key => "/etc/pki/tls/private/logstash-forwarder.key"
  }
}

```

This is my 30-elasticsearch-output.conf

```
output {
  elasticsearch { hosts => ["elk.systemctl.lan:9200"] }
  stdout { codec => rubydebug }
}

```

Host is CentOS 7, firewalld and selinux are disabled while testing.

Can anyone point me in a starting direction?

Thanks

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [December 14, 2015, 9:23pm UTC](https://discuss.elastic.co/t/logstash-not-binding-to-5504/37166/2 "2015-12-14T21:23:08Z")

</div>

If Logstash can't bind to port 5044 there should be something about it in the log. However, since you're not including `-a` when invoking netstat it'll only include existing connections and not ports being listened to so it's not very surprising that you won't see anything (and the netstat output will never contain "logstash").

The message in the Logstash log file indicates that it can't connect to Elasticsearch.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:18am UTC](https://discuss.elastic.co/t/logstash-not-binding-to-5504/37166/3 "2017-07-06T05:18:30Z")

</div>