Lost connection when adding filter files and patterns in logstash

Elastic Stack Logstash
1

i work with zimbra i have created a grok filter for mailbox.log and a pattern file

i have put the filter file called zimbra_mailbox.conf in /etc/logstash/conf.d/
and i have created a directory called patterns in /etc/logstash/ and puted the pattern file into it

and i made this commande chown logstash:logstash /etc/logstash/patterns/zimbra

but when i open logsatsh-forwader.err to see how the transfer of log is going but i get lost connection connection failure :frowning:
could you help me please to know where is my problem

2

Please show the exact error message you get.

3

this is what i get

2017/04/12 19:51:02.154449 Connecting to [192.168.1.103]:5043 (192.168.1.103)
2017/04/12 19:51:17.155362 Failure connecting to 192.168.1.103: dial tcp 192.168.1.103:5043: i/o timeout

4

Looks like a network connectivity issue. Have you verified that you can connect outside of Filebeat but on the same machine?

5

i am not using filea beat ima using logstash-forwarder

6

That shouldn't make a difference in this case. Anyway, logstash-forwarder is deprecated and should be replaced by Filebeat whenever possible.

7

i see but i could not get the problem if i don't add the filters and patterns it works but when i add them it give me that erreur please can you help me

8

Have you looked in Logstash's log to see if it reports any problems?

9

i have installed filebeat and the problem seems to be resolved and i added a new filter of zimbra under /etc/logstash/conf.d
and i added a pattern file in /etc/logstash/patterns
and filebeat is forwarding the files but how can i a see the new filed added by the filter :slight_smile:

10

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.