Logstash port 5044 problem not listening!

Elastic Stack Logstash
1

logstash port 5044 not binding, i tried to change port to 9066 in my client everything looks ok !!

2018-04-09T19:07:06.934-0300 DEBUG [prospector] log/prospector.go:168
Prospector states cleaned up. Before: 1, After: 1
2018-04-09T19:07:07.117-0300 ERROR pipeline/output.go:74 Failed to connec
t: Get http://10.2.3.65:9066: dial tcp 10.2.3.65:9066: connectex: No connection
could be made because the target machine actively refused it.
2018-04-09T19:07:07.118-0300 DEBUG [elasticsearch] elasticsearch/client.go:
666 ES Ping(url=http://10.2.3.65:9066)
2018-04-09T19:07:08.125-0300 DEBUG [elasticsearch] elasticsearch/client.go:
670 Ping request failed with: Get http://10.2.3.65:9066: dial tcp 10.2.3.65:
9066: connectex: No connection could be made because the target machine actively
refused it.
2018-04-09T19:07:14.475-0300 INFO [monitoring] log/log.go:124 Non-zero
metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"syst
em":{"ticks":515,"time":515},"total":{"ticks":2390,"time":2390,"value":2390},"us
er":{"ticks":1875,"time":1875}},"info":{"ephemeral_id":"2f8a0544-6148-4083-a3dd-
a803790b63cc","uptime":{"ms":4140069}},"memstats":{"gc_next":9617888,"memory_all
oc":4844824,"memory_total":74360696}},"filebeat":{"harvester":{"open_files":1,"r
unning":1}},"libbeat":{"config":{"module":{"running":0}},"pipeline":{"clients":1
,"events":{"active":4117,"retry":50}}},"registrar":{"states":{"current":2}}}}}
2018-04-09T19:07:16.936-0300 DEBUG [prospector] prospector/prospector.go
:124 Run prospector
2018-04-09T19:07:16.937-0300 DEBUG [prospector] log/prospector.go:147
Start next scan

All my configs files looks ok !! But 5044 port logstash don't work, i can't start it

Elasticsearch - 6.2.3
Logstash - 6.2.3
Kibana - 6.2

Please some light, some help !!
If you need any more information.
#JeFF

2

First, what does the input section of your Logstash pipeline configuration look like? There should be a configuration for beats if the pipeline is attempting to set up a listener for Filebeat, and that configuration may include directives, which will tell Logstash how to listen for new connections (see also: Beats Input Plugin docs).

Second, when Logstash starts up, do its logs indicate that it successfully bound to the configured port? If so, can you connect to the bound port on the Logstash host?

nc -z localhost 9066

If so, can you connect to the Logstash host's external IP from the Logstash host machine? From the logs you pasted, I gather the Logstash host is 10.2.3.65, so that would be:

nc -z 10.2.3.65 9066

If so, can you connect to the Logstash host's external IP from the machine on which you have the Filebeat?

nc -z 10.2.3.65 9066
3

Good morning... Yaauie

I have no answer from nc command, the same answer when i was using 5044 tcp port... I don't have a firewall on my network 'nd in my host fw is disable.

[root@elk-node ~]# nc localhost 9066
Ncat: Connection refused.
[root@elk-node ~]# nc 10.2.3.65 9066
Ncat: Connection refused.
[root@elk-node ~]#

[root@elk-node ~]# service firewalld status
Redirecting to /bin/systemctl status firewalld.service
● firewalld.service - firewalld - dynamic firewall daemon
Loaded: loaded (/usr/lib/systemd/system/firewalld.service; disabled; vendor preset: enabled)
Active: inactive (dead)
Docs: man:firewalld(1)
[root@elk-node ~]#

[root@elk-node ~]# netstat -plnt
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 1236/nginx: master
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 994/sshd
tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN 1210/master
tcp 0 0 0.0.0.0:5601 0.0.0.0:* LISTEN 692/node
tcp6 0 0 127.0.0.1:9200 :::* LISTEN 11102/java
tcp6 0 0 ::1:9200 :::* LISTEN 11102/java
tcp6 0 0 127.0.0.1:9300 :::* LISTEN 11102/java
tcp6 0 0 ::1:9300 :::* LISTEN 11102/java
tcp6 0 0 :::22 :::* LISTEN 994/sshd
tcp6 0 0 :::3000 :::* LISTEN 32017/grafana-serve
tcp6 0 0 ::1:25 :::* LISTEN 1210/master
[root@elk-node ~]#

4

I'll repeat:

And:

5

My input section logstash...

[root@elk-node ~]# cat /etc/logstash/logstash.yml
path.data: /var/lib/logstash
path.config: /etc/logstash/conf.d
input {
beats {
port => 5044
type => "JSON"
ssl => true
ssl_certificate => "/etc/pki/tls/certs/logstash-forwarder.crt"
ssl_key => "/etc/pki/tls/private/logstash-forwarder.key"
congestion_thershold => 1000
}
}
[root@elk-node ~]#

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.