# Monitoring logstash with port 9600

**URL:** <https://discuss.elastic.co/t/monitoring-logstash-with-port-9600/133807>\
**Category:** Logstash\
**Created:** [May 30, 2018, 7:34am UTC](https://discuss.elastic.co/t/monitoring-logstash-with-port-9600/133807 "2018-05-30T07:34:11Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![zeenon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zeenon/32/24883_2.png) [@zeenon](https://discuss.elastic.co/u/zeenon)\
**Post date:** [May 30, 2018, 7:34am UTC](https://discuss.elastic.co/t/monitoring-logstash-with-port-9600/133807/1 "2018-05-30T07:34:12Z")

</div>

Hi,  
I am running logstash 5.6.4 and I have set  
http.port: 9600-9700  
in my logstash.yml configuration file.  
On the logstash server, all is fine

> $ telnet 127.0.0.1 9600  
> Trying 127.0.0.1...  
> Connected to 127.0.0.1.  
> Escape character is '^]'.

but an another server cannot check the port 9600

> $ telnet ud0tx057 9600  
> Trying 126.246.159.200...  
> telnet: connect to address 126.246.159.200: Connection refused

but ping and ssh are OK  
What's wrong ?  
does it exist a netmask to allow/block the other servers ?

thanks for your tips

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 30, 2018, 12:52pm UTC](https://discuss.elastic.co/t/monitoring-logstash-with-port-9600/133807/2 "2018-05-30T12:52:52Z")

</div>

Does 'telnet 126.246.159.200 9600' work on the server itself? Do you have http.host set to 127.0.0.1? If you do 'netstat -an | grep 9600' then what do you get?

---

<div class="post-metadata">

**Author:** ![zeenon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zeenon/32/24883_2.png) [@zeenon](https://discuss.elastic.co/u/zeenon)\
**Post date:** [May 31, 2018, 1:46pm UTC](https://discuss.elastic.co/t/monitoring-logstash-with-port-9600/133807/3 "2018-05-31T13:46:59Z")

</div>

On the server itself, 'telnet 126.246.159.200 9600' does not work

> telnet 126.246.159.200 9600  
> Trying 126.246.159.200...  
> telnet: connect to address 126.246.159.200: Connection refused

> fgrep http. /etc/logstash/logstash.yml  
> http.host: "127.0.0.1"  
> http.port: 9600-9700

> netstat -an | grep 9600  
> tcp 0 0 127.0.0.1:9600 0.0.0.0:\* LISTEN

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 31, 2018, 1:55pm UTC](https://discuss.elastic.co/t/monitoring-logstash-with-port-9600/133807/4 "2018-05-31T13:55:30Z")

</div>

OK, so you have http.host set to 127.0.0.1, which is referred to as "localhost". It is only accessible from the server itself. Change http.host to be 126.246.159.200 and anyone will be able to access it remotely.

I cannot speak to the security implications of exposing your monitoring ports to remote access.

---

<div class="post-metadata">

**Author:** ![zeenon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zeenon/32/24883_2.png) [@zeenon](https://discuss.elastic.co/u/zeenon)\
**Post date:** [May 31, 2018, 1:58pm UTC](https://discuss.elastic.co/t/monitoring-logstash-with-port-9600/133807/5 "2018-05-31T13:58:56Z")

</div>

thanks, it works

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 28, 2018, 1:58pm UTC](https://discuss.elastic.co/t/monitoring-logstash-with-port-9600/133807/6 "2018-06-28T13:58:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.