# Logstash not listening on 5044

**URL:** https://discuss.elastic.co/t/logstash-not-listening-on-5044/181642
**Category:** Logstash
**Created:** [May 17, 2019, 7:17pm UTC](https://discuss.elastic.co/t/logstash-not-listening-on-5044/181642 "2019-05-17T19:17:09Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![thadc](https://avatars.discourse-cdn.com/v4/letter/t/7cd45c/32.png) [@thadc](https://discuss.elastic.co/u/thadc)
#### Post date: [May 17, 2019, 7:17pm UTC](https://discuss.elastic.co/t/logstash-not-listening-on-5044/181642/1 "2019-05-17T19:17:10Z")

</div>

Hi, I have had filebeat/logstash/elasticsearch running successfully on (I'll call it) boxA for several weeks. Recently I had the need to set up on (I'll call it) boxB. I am using the same version of the elk components on both boxes. I am using the same filebeat.yml on both boxes. I am using the same logstash.conf and logstash.yml on both boxes.

With logstash and filebeat running on boxB, I noticed that updated log file picked up from filebeat was not being processed by logstash. When I looked at the logstash log I noticed:

~stuff at start of line~ Failed to connect to backoff(async(tcp://localhost:5044)): dial tcp 127.0.0.1:5044)) connect: connection refused

filebeat would get the same error with each attempt to reconnect.

logstash did not indicate any error when starting up. The salient messages at startup (as far as 5044) are:

~stuff at start of line~ Beats inputs: Starting input listener {:address=\>"0.0.0:5044}  
~stuff at start of line~ Starting server on port: 5044  
~stuff at start of line~ Successfully started logstash API endpoint {: port=\>9600}

, implying a successful start

Here is logstash.conf input section:

input {  
beats {  
port=\> 5044  
type=\> "log"  
}  
}

Interestingly, on boxA, once logstash is started I can see that it is listening on 5044:

-bash-blah$ sudo lsof -i -P -n | grep 5044  
~stuff at start of line~ TCP \*:5044 (LISTEN)

,on box B, same lsof command returns nothing.

Finally, I am told with great confidence by the sys admin team responsible that all ports are open on boxB .

I would be extremely grateful for any ideas of how to continue with troubleshooting and fixing my problem. Grateful for any response. Thank you!

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [May 17, 2019, 8:09pm UTC](https://discuss.elastic.co/t/logstash-not-listening-on-5044/181642/2 "2019-05-17T20:09:44Z")

</div>

I don't have great hopes for it making a difference, but if filebeat is connecting to 127.0.0.1 then I would make logstash bind to that by specifying the host option on the beats input.

---

<div class="post-metadata">

### Author: ![thadc](https://avatars.discourse-cdn.com/v4/letter/t/7cd45c/32.png) [@thadc](https://discuss.elastic.co/u/thadc)
#### Post date: [May 20, 2019, 11:17am UTC](https://discuss.elastic.co/t/logstash-not-listening-on-5044/181642/3 "2019-05-20T11:17:59Z")

</div>

Thanks for the response. However I am looking at the filebeats configuration and see nothing regarding configuring input hosts on the filebeat inputs section. So..

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [May 20, 2019, 1:17pm UTC](https://discuss.elastic.co/t/logstash-not-listening-on-5044/181642/4 "2019-05-20T13:17:35Z")

</div>

I am talking about the logstash configuration, not the filebeat configuration.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 17, 2019, 1:17pm UTC](https://discuss.elastic.co/t/logstash-not-listening-on-5044/181642/5 "2019-06-17T13:17:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
