Logstash RabbitMQ Output

Elastic Stack Logstash
1

I am having trouble getting logstash to output to rabbit on a non-default port.

My output configuration for logstash is ...

rabbitmq {
durable => "true"
persistent => "true"
exchange => "secure-logs-exch"
exchange_type => "direct"
vhost => "logstash_secure-ci"
key => "secure.apps.logs"
user => "logstash"
password => "password"
host => "prcore"
port => "6672"
}

My rabbitmq server is listening on 6672.

But from the logstash logs I see the following...

[2018-04-23T08:23:59,999][ERROR][logstash.outputs.rabbitmq] RabbitMQ connection error, will retry. {:error_message=>"Connection to localhost:5672 refused", :exception=>"MarchHare::ConnectionRefused"}

And a tcpdump on the target server shows...

08:38:43.659744 IP 192.168.10.4.45614 > 192.168.10.2.amqp: Flags [S], seq 3659372810, win 29200, options [mss 1460,sackOK,TS val 1146040 ecr 0,nop,wscale 7], length 0
08:38:43.659793 IP 192.168.10.2.amqp > 192.168.10.4.45614: Flags [R.], seq 0, ack 3659372811, win 0, length 0

I am using Logstash 6.2.3, and Rabbit 3.7.3 (Erlang 20.3) - I have also had this on an earlier version of RabbitMQ.

Thanks for any help anyone can give.

2

Reset

Anything in your RBMQ logs to denote why the connection was closed?

3

Nothing comes in to RBMQ logs at all.

RBMQ is listening on 6672, and all the network traffic from logstash hits the server on 5672.

4

Okay perhaps we are not getting that far downstream

I presume both services are running on the same server?
netstat |grep 5672 Are we listening on the needful port?

5

No they are running on different servers.
Logstash is running on one server and rabbitmq on a different server.

There are no firewalls on either server.

netstat gives the following ...
netstat -an | grep 672
tcp 0 0 0.0.0.0:25672 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:15672 0.0.0.0:* LISTEN
tcp6 0 0 :::6672 :::* LISTEN

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.