Hi ,
I am running the LS-shipper on 5000 port.
input {
beats {
port=>"5000"
ssl_certificate => "/opt/logstash-elk/SSL/hostName.lij.fi.cer"
ssl_key => "/opt/logstash-elk/SSL/logstash.key"
}
}
When I conect using curl http://LSHostName:5000 it says, curl: (52) Empty reply from server, means it connects.
As soon as I start the FB, Shipper starts writing below logs.
{:timestamp=>"2016-04-28T12:04:57.175000+0300", :message=>"Beats Input: Remote connection closed", :peer=>"10.xxx.x.xxx:50932", :exception=>#<Lumberjack::Beats::Connection::ConnectionClosed: Lumberjack::Beats::Connection::ConnectionClosed wrapping: Lumberjack::Beats::Parser::UnsupportedProtocol, unsupported protocol 22>, :level=>:warn}
I am not able to understand the reason behind this.
Sometime it seems chicken and age situation.
When filebeat is stopped, LS says connection closed. Is it like LS stopped at the moment? If Yes then how could FB will make connection with LS when its stopped? Thats why I am saying its chicken and egg situation.
NOTE: this happens only when I enable tsl mode from FB. Otherwise it connects properly.
br,
Sunil
