# Logstash port 5044 problem not listening!

**URL:** https://discuss.elastic.co/t/logstash-port-5044-problem-not-listening/127396
**Category:** Logstash
**Created:** [April 9, 2018, 10:13pm UTC](https://discuss.elastic.co/t/logstash-port-5044-problem-not-listening/127396 "2018-04-09T22:13:33Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![analistajeff](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/analistajeff/32/29817_2.png) [@analistajeff](https://discuss.elastic.co/u/analistajeff)
#### Post date: [April 9, 2018, 10:13pm UTC](https://discuss.elastic.co/t/logstash-port-5044-problem-not-listening/127396/1 "2018-04-09T22:13:33Z")

</div>

logstash port 5044 not binding, i tried to change port to 9066 in my client everything looks ok !!

2018-04-09T19:07:06.934-0300 DEBUG [prospector] log/prospector.go:168  
Prospector states cleaned up. Before: 1, After: 1  
2018-04-09T19:07:07.117-0300 ERROR pipeline/output.go:74 Failed to connec  
t: Get [http://10.2.3.65:9066](http://10.2.3.65:9066): dial tcp 10.2.3.65:9066: connectex: No connection  
could be made because the target machine actively refused it.  
2018-04-09T19:07:07.118-0300 DEBUG [elasticsearch] elasticsearch/client.go:  
666 ES Ping(url=http://10.2.3.65:9066)  
2018-04-09T19:07:08.125-0300 DEBUG [elasticsearch] elasticsearch/client.go:  
670 Ping request failed with: Get [http://10.2.3.65:9066](http://10.2.3.65:9066): dial tcp 10.2.3.65:  
9066: connectex: No connection could be made because the target machine actively  
refused it.  
2018-04-09T19:07:14.475-0300 INFO [monitoring] log/log.go:124 Non-zero  
metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"syst  
em":{"ticks":515,"time":515},"total":{"ticks":2390,"time":2390,"value":2390},"us  
er":{"ticks":1875,"time":1875}},"info":{"ephemeral\_id":"2f8a0544-6148-4083-a3dd-  
a803790b63cc","uptime":{"ms":4140069}},"memstats":{"gc\_next":9617888,"memory\_all  
oc":4844824,"memory\_total":74360696}},"filebeat":{"harvester":{"open\_files":1,"r  
unning":1}},"libbeat":{"config":{"module":{"running":0}},"pipeline":{"clients":1  
,"events":{"active":4117,"retry":50}}},"registrar":{"states":{"current":2}}}}}  
2018-04-09T19:07:16.936-0300 DEBUG [prospector] prospector/prospector.go  
:124 Run prospector  
2018-04-09T19:07:16.937-0300 DEBUG [prospector] log/prospector.go:147  
Start next scan

All my configs files looks ok !! But 5044 port logstash don't work, i can't start it

Elasticsearch - 6.2.3  
Logstash - 6.2.3  
Kibana - 6.2

Please some light, some help !!  
If you need any more information.  
#JeFF

---

<div class="post-metadata">

### Author: ![yaauie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yaauie/32/23363_2.png) [@yaauie](https://discuss.elastic.co/u/yaauie)
#### Post date: [April 10, 2018, 12:06am UTC](https://discuss.elastic.co/t/logstash-port-5044-problem-not-listening/127396/2 "2018-04-10T00:06:24Z")

</div>

First, what does the `input` section of your Logstash pipeline configuration look like? There should be a configuration for `beats` if the pipeline is attempting to set up a listener for Filebeat, and that configuration may include directives, which will tell Logstash how to listen for new connections (see also: [Beats Input Plugin docs](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-beats.html#plugins-inputs-beats-port)).

Second, when Logstash starts up, do its logs indicate that it successfully bound to the configured port? If so, can you connect to the bound port on the Logstash host?

```auto
nc -z localhost 9066

```

If so, can you connect to the Logstash host's _external_ IP from the Logstash host machine? From the logs you pasted, I gather the Logstash host is `10.2.3.65`, so that would be:

```auto
nc -z 10.2.3.65 9066

```

If so, can you connect to the Logstash host's _external_ IP from the machine on which you have the Filebeat?

```auto
nc -z 10.2.3.65 9066

```

---

<div class="post-metadata">

### Author: ![analistajeff](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/analistajeff/32/29817_2.png) [@analistajeff](https://discuss.elastic.co/u/analistajeff)
#### Post date: [April 10, 2018, 12:39pm UTC](https://discuss.elastic.co/t/logstash-port-5044-problem-not-listening/127396/3 "2018-04-10T12:39:51Z")

</div>

Good morning... Yaauie

I have no answer from nc command, the same answer when i was using 5044 tcp port... I don't have a firewall on my network 'nd in my host fw is disable.

[root@elk-node ~]# nc localhost 9066  
Ncat: Connection refused.  
[root@elk-node ~]# nc 10.2.3.65 9066  
Ncat: Connection refused.  
[root@elk-node ~]#

[root@elk-node ~]# service firewalld status  
Redirecting to /bin/systemctl status firewalld.service  
● firewalld.service - firewalld - dynamic firewall daemon  
Loaded: loaded (/usr/lib/systemd/system/firewalld.service; disabled; vendor preset: enabled)  
Active: inactive (dead)  
Docs: man:firewalld(1)  
[root@elk-node ~]#

[root@elk-node ~]# netstat -plnt  
Active Internet connections (only servers)  
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name  
tcp 0 0 0.0.0.0:80 0.0.0.0:\* LISTEN 1236/nginx: master  
tcp 0 0 0.0.0.0:22 0.0.0.0:\* LISTEN 994/sshd  
tcp 0 0 127.0.0.1:25 0.0.0.0:\* LISTEN 1210/master  
tcp 0 0 0.0.0.0:5601 0.0.0.0:\* LISTEN 692/node  
tcp6 0 0 127.0.0.1:9200 :::\* LISTEN 11102/java  
tcp6 0 0 ::1:9200 :::\* LISTEN 11102/java  
tcp6 0 0 127.0.0.1:9300 :::\* LISTEN 11102/java  
tcp6 0 0 ::1:9300 :::\* LISTEN 11102/java  
tcp6 0 0 :::22 :::\* LISTEN 994/sshd  
tcp6 0 0 :::3000 :::\* LISTEN 32017/grafana-serve  
tcp6 0 0 ::1:25 :::\* LISTEN 1210/master  
[root@elk-node ~]#

---

<div class="post-metadata">

### Author: ![yaauie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yaauie/32/23363_2.png) [@yaauie](https://discuss.elastic.co/u/yaauie)
#### Post date: [April 10, 2018, 9:44pm UTC](https://discuss.elastic.co/t/logstash-port-5044-problem-not-listening/127396/4 "2018-04-10T21:44:24Z")

</div>

I'll repeat:

> [@yaauie](#):
>
> First, what does the `input` section of your Logstash pipeline configuration look like?

And:

> [@yaauie](#):
>
> Second, when Logstash starts up, do its logs indicate that it successfully bound to the configured port?

---

<div class="post-metadata">

### Author: ![analistajeff](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/analistajeff/32/29817_2.png) [@analistajeff](https://discuss.elastic.co/u/analistajeff)
#### Post date: [April 10, 2018, 9:52pm UTC](https://discuss.elastic.co/t/logstash-port-5044-problem-not-listening/127396/5 "2018-04-10T21:52:16Z")

</div>

My input section logstash...

[root@elk-node ~]# cat /etc/logstash/logstash.yml  
path.data: /var/lib/logstash  
path.config: /etc/logstash/conf.d  
input {  
beats {  
port =\> 5044  
type =\> "JSON"  
ssl =\> true  
ssl\_certificate =\> "/etc/pki/tls/certs/logstash-forwarder.crt"  
ssl\_key =\> "/etc/pki/tls/private/logstash-forwarder.key"  
congestion\_thershold =\> 1000  
}  
}  
[root@elk-node ~]#

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 8, 2018, 9:52pm UTC](https://discuss.elastic.co/t/logstash-port-5044-problem-not-listening/127396/6 "2018-05-08T21:52:29Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
