Logstash not working, but says configuration ok

(Luvpreet Singh) #1

Logstash is creating problems, I am using it with filebeat to send logs to elastic. When I start it, it says every thing is ok,

luvpreet@DHARI-Inspiron-3542:/usr/share/logstash$ sudo bin/logstash --path.settings /etc/logstash/ -f /etc/logstash/conf.d/02-beats--input.conf 
Sending Logstash's logs to /var/log/logstash which is now configured via log4j2.properties
Configuration OK

And this is the filebeat.yml file ,

- input_type: log
     - /var/log/nginx/kibana_access.log
  document_type: nginx
  hosts: [""]

And this is the logstash conf file,

input {
beats {
    port => 5044

output {
elasticsearch {
   hosts => [""]
   manage_template => false
   index => "%{type}-index"
   document_type => "[type]"

But then in the logs of filebeat, I see this,

2017-04-24T12:46:21+05:30 ERR Connecting error publishing events (retrying): dial tcp getsockopt: connection refused

When I see sudo netstat -ntlp, the port 5044 is not open.

Why the port is not opened ?

(Mark Walkom) #2

What OS are you on?

(Luvpreet Singh) #3

Ubuntu 16.04 LTS, laptop - DELL inspiron

(Magnus Bäck) #4

Is Logstash running? Have you looked in the Logstash logs?

(Luvpreet Singh) #5

Yes, it is running. In the logs, it firstly checks codecs, then the beats
input, and then the output to elasticsearch.

Do I have to specify the " host= " in the logstash configuration
somewhere ?

(Magnus Bäck) #6

Do I have to specify the " host= " in the logstash configuration somewhere ?

That's the default so it shouldn't be necessary.

(Luvpreet Singh) #7

so,where is the problem ?

If I write directly to elastic using filebeat, without logstash, the data
is written perfectly. But not ig I use logstash.

(system) #8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.