Logstash not working, but says configuration ok

Elastic Stack Logstash
1

Logstash is creating problems, I am using it with filebeat to send logs to elastic. When I start it, it says every thing is ok,

luvpreet@DHARI-Inspiron-3542:/usr/share/logstash$ sudo bin/logstash --path.settings /etc/logstash/ -f /etc/logstash/conf.d/02-beats--input.conf 
Sending Logstash's logs to /var/log/logstash which is now configured via log4j2.properties
Configuration OK

And this is the filebeat.yml file ,

filebeat.prospectors:
- input_type: log
  paths:
     - /var/log/nginx/kibana_access.log
  document_type: nginx
output.logstash:
  hosts: ["127.0.0.1:5044"]

And this is the logstash conf file,

input {
beats {
    port => 5044
  }
}

output {
elasticsearch {
   hosts => ["127.0.0.1:9200"]
   manage_template => false
   index => "%{type}-index"
   document_type => "[type]"
 }
}

But then in the logs of filebeat, I see this,

2017-04-24T12:46:21+05:30 ERR Connecting error publishing events (retrying): dial tcp 127.0.0.1:5044: getsockopt: connection refused

When I see sudo netstat -ntlp, the port 5044 is not open.

Why the port is not opened ?

2

What OS are you on?

3

@warkolm
Ubuntu 16.04 LTS, laptop - DELL inspiron

4

Is Logstash running? Have you looked in the Logstash logs?

5

Yes, it is running. In the logs, it firstly checks codecs, then the beats
input, and then the output to elasticsearch.

Do I have to specify the " host=0.0.0.0 " in the logstash configuration
somewhere ?

6

Do I have to specify the " host=0.0.0.0 " in the logstash configuration somewhere ?

That's the default so it shouldn't be necessary.

7

so,where is the problem ?

If I write directly to elastic using filebeat, without logstash, the data
is written perfectly. But not ig I use logstash.

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.