# Logstash not working, but says configuration ok

**URL:** <https://discuss.elastic.co/t/logstash-not-working-but-says-configuration-ok/83367>\
**Category:** Logstash\
**Created:** [April 24, 2017, 7:33am UTC](https://discuss.elastic.co/t/logstash-not-working-but-says-configuration-ok/83367 "2017-04-24T07:33:06Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![sLuvpreet33](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sluvpreet33/32/50626_2.png) [@sLuvpreet33](https://discuss.elastic.co/u/sLuvpreet33)\
**Post date:** [April 24, 2017, 7:33am UTC](https://discuss.elastic.co/t/logstash-not-working-but-says-configuration-ok/83367/1 "2017-04-24T07:33:06Z")

</div>

Logstash is creating problems, I am using it with filebeat to send logs to elastic. When I start it, it says every thing is ok,

```
luvpreet@DHARI-Inspiron-3542:/usr/share/logstash$ sudo bin/logstash --path.settings /etc/logstash/ -f /etc/logstash/conf.d/02-beats--input.conf 
Sending Logstash's logs to /var/log/logstash which is now configured via log4j2.properties
Configuration OK

```

And this is the filebeat.yml file ,

```
filebeat.prospectors:
- input_type: log
  paths:
     - /var/log/nginx/kibana_access.log
  document_type: nginx
output.logstash:
  hosts: ["127.0.0.1:5044"]

```

And this is the logstash conf file,

```
input {
beats {
    port => 5044
  }
}

output {
elasticsearch {
   hosts => ["127.0.0.1:9200"]
   manage_template => false
   index => "%{type}-index"
   document_type => "[type]"
 }
}

```

But then in the logs of filebeat, I see this,

```
2017-04-24T12:46:21+05:30 ERR Connecting error publishing events (retrying): dial tcp 127.0.0.1:5044: getsockopt: connection refused

```

When I see `sudo netstat -ntlp`, the port 5044 is not open.

Why the port is not opened ?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [April 24, 2017, 7:42am UTC](https://discuss.elastic.co/t/logstash-not-working-but-says-configuration-ok/83367/2 "2017-04-24T07:42:56Z")

</div>

What OS are you on?

---

<div class="post-metadata">

**Author:** ![sLuvpreet33](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sluvpreet33/32/50626_2.png) [@sLuvpreet33](https://discuss.elastic.co/u/sLuvpreet33)\
**Post date:** [April 24, 2017, 7:55am UTC](https://discuss.elastic.co/t/logstash-not-working-but-says-configuration-ok/83367/3 "2017-04-24T07:55:03Z")

</div>

@warkolm  
Ubuntu 16.04 LTS, laptop - DELL inspiron

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 24, 2017, 8:43am UTC](https://discuss.elastic.co/t/logstash-not-working-but-says-configuration-ok/83367/4 "2017-04-24T08:43:45Z")

</div>

Is Logstash running? Have you looked in the Logstash logs?

---

<div class="post-metadata">

**Author:** ![sLuvpreet33](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sluvpreet33/32/50626_2.png) [@sLuvpreet33](https://discuss.elastic.co/u/sLuvpreet33)\
**Post date:** [April 24, 2017, 8:58am UTC](https://discuss.elastic.co/t/logstash-not-working-but-says-configuration-ok/83367/5 "2017-04-24T08:58:22Z")

</div>

Yes, it is running. In the logs, it firstly checks codecs, then the beats  
input, and then the output to elasticsearch.

Do I have to specify the " host=0.0.0.0 " in the logstash configuration  
somewhere ?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 24, 2017, 9:46am UTC](https://discuss.elastic.co/t/logstash-not-working-but-says-configuration-ok/83367/6 "2017-04-24T09:46:58Z")

</div>

> Do I have to specify the " host=0.0.0.0 " in the logstash configuration somewhere ?

That's the default so it shouldn't be necessary.

---

<div class="post-metadata">

**Author:** ![sLuvpreet33](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sluvpreet33/32/50626_2.png) [@sLuvpreet33](https://discuss.elastic.co/u/sLuvpreet33)\
**Post date:** [April 24, 2017, 10:17am UTC](https://discuss.elastic.co/t/logstash-not-working-but-says-configuration-ok/83367/7 "2017-04-24T10:17:56Z")

</div>

so,where is the problem ?

If I write directly to elastic using filebeat, without logstash, the data  
is written perfectly. But not ig I use logstash.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 22, 2017, 10:26am UTC](https://discuss.elastic.co/t/logstash-not-working-but-says-configuration-ok/83367/8 "2017-05-22T10:26:29Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.