# No communication between Filebeat and Logstash **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [July 25, 2016, 4:20pm UTC](https://discuss.elastic.co/t/no-communication-between-filebeat-and-logstash/56317 "2016-07-25T16:20:09Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![Gisamark](https://avatars.discourse-cdn.com/v4/letter/g/c0e974/32.png) [@Gisamark](https://discuss.elastic.co/u/Gisamark)\ **Post date:** [July 25, 2016, 4:20pm UTC](https://discuss.elastic.co/t/no-communication-between-filebeat-and-logstash/56317/1 "2016-07-25T16:20:09Z")
Hi all ! I tried to install the ELK solution on a server and filebeat on my client, but it seems that there is no communication between the two... I tried > beatname -c config.yml -e -d "\*" > to help you but I get "command not found". My config : **ELK Server** - Debian 8.5 I followed theses steps : [How To Install Elasticsearch, Logstash, and Kibana (ELK Stack) on Ubuntu 14.04 | DigitalOcean](https://www.digitalocean.com/community/tutorials/how-to-install-elasticsearch-logstash-and-kibana-elk-stack-on-ubuntu-14-04) **Client Server** (the one I want to log) - Centos 6.7 I followed theses steps : [How To Install Elasticsearch, Logstash, and Kibana (ELK Stack) on CentOS 7 | DigitalOcean](https://www.digitalocean.com/community/tutorials/how-to-install-elasticsearch-logstash-and-kibana-elk-stack-on-centos-7) Then I tested it with > curl -XGET '[http://localhost:9200/filebeat-\*/\_search?pretty](http://localhost:9200/filebeat-*/_search?pretty)' > on my ELK server but i get 0 hits... Do you have any idea to find the issue ? Thanks a lot ! Gisamark ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [July 25, 2016, 4:49pm UTC](https://discuss.elastic.co/t/no-communication-between-filebeat-and-logstash/56317/2 "2016-07-25T16:49:39Z")
which beat are you testing? filebeat? Then try `$ filebeat -c -e -d '*'` in order to print some debug to console. ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [July 25, 2016, 4:51pm UTC](https://discuss.elastic.co/t/no-communication-between-filebeat-and-logstash/56317/3 "2016-07-25T16:51:33Z")
I really recommend following the [Filebeat getting started guide](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-getting-started.html) . And if you are going to use Logstash, see this short guide on [how to configure Logstash for Beats](https://www.elastic.co/guide/en/beats/libbeat/current/logstash-installation.html). If you are still having a problems after following the our guides, please post your versions (Filebeat/Logstash/Elasticsearch), configs, and log messages. > [@Gisamark](#): > > I tried > > beatname -c config.yml -e -d "\*" "beatname" \<-- That's supposed to be "filebeat". Did you find that in documentation somewhere? ---
**Author:** ![Gisamark](https://avatars.discourse-cdn.com/v4/letter/g/c0e974/32.png) [@Gisamark](https://discuss.elastic.co/u/Gisamark)\ **Post date:** [July 28, 2016, 1:56pm UTC](https://discuss.elastic.co/t/no-communication-between-filebeat-and-logstash/56317/4 "2016-07-28T13:56:18Z")
Thank you. I find that command on Elastic forum, "How to report an issue" : > [@Beats: How to report an issue](https://discuss.elastic.co/t/beats-how-to-report-an-issue/38301): > > This forum is intended for all discussions and issues related to the beats projects. Each Beat has its own subforum, so for beat specific issues, please use the specific forum. In case you have issue with the installation of a beat or running a beat, please first search the forum if someone else already had the issue and it was resolved. In case you open a topic with a new issue or comment, please always provide the following information: Beat version Operating System Configuration To debug … The result of that command ` filebeat -c config.yml -e -d "*"` gives me a LOT of text which I cannot copy here... ---
**Author:** ![Gisamark](https://avatars.discourse-cdn.com/v4/letter/g/c0e974/32.png) [@Gisamark](https://discuss.elastic.co/u/Gisamark)\ **Post date:** [July 28, 2016, 2:50pm UTC](https://discuss.elastic.co/t/no-communication-between-filebeat-and-logstash/56317/5 "2016-07-28T14:50:31Z")
Ok, I can see in the debug mode of filebeat : ``` 2016/07/28 14:44:12.485085 publish.go:109: DBG Publish: { "@timestamp": "2016-07-28T14:44:11.990Z", "beat": { "hostname": "localhost.localdomain", "name": "localhost.localdomain" }, "count": 1, "fields": null, "input_type": "log", "message": "Jul 25 09:20:32 localhost /usr/bin/filebeat[2658]: transport.go:125: SSL client failed to connect with: dial tcp 192.168.2.80:5044: getsockopt: connection refused", "offset": 310642, "source": "/var/log/messages", "type": "syslog" } ``` So I guess i made a mistake with the SSL configuration ? ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [July 28, 2016, 3:45pm UTC](https://discuss.elastic.co/t/no-communication-between-filebeat-and-logstash/56317/6 "2016-07-28T15:45:19Z")
can you ping and telnet the logstash host? connection refused is not cause of SSL, but network. ---
**Author:** ![Gisamark](https://avatars.discourse-cdn.com/v4/letter/g/c0e974/32.png) [@Gisamark](https://discuss.elastic.co/u/Gisamark)\ **Post date:** [July 28, 2016, 4:07pm UTC](https://discuss.elastic.co/t/no-communication-between-filebeat-and-logstash/56317/7 "2016-07-28T16:07:18Z")
I can ping and Telnet it. But i copied the wrong message. The issue seems to be "EOF" : ``` 2016/07/28 16:06:17.372218 output.go:87: DBG output worker: publish 1024 events 2016/07/28 16:06:17.372303 client.go:146: DBG Try to publish 1024 events to logstash with window size 10 2016/07/28 16:06:17.384023 client.go:105: DBG close connection 2016/07/28 16:06:17.384189 client.go:124: DBG 0 events out of 1024 events sent to logstash. Continue sending ... 2016/07/28 16:06:17.384218 single.go:76: INFO Error publishing events (retrying): EOF 2016/07/28 16:06:17.384240 single.go:152: INFO send fail 2016/07/28 16:06:17.384259 single.go:159: INFO backoff retry: 1s ^C2016/07/28 16:06:17.666590 service.go:30: DBG Received sigterm/sigint, stopping ``` Any idea ? ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [July 28, 2016, 9:02pm UTC](https://discuss.elastic.co/t/no-communication-between-filebeat-and-logstash/56317/8 "2016-07-28T21:02:47Z")
can you share beats output configuration and logstash input config? ---
**Author:** ![Gisamark](https://avatars.discourse-cdn.com/v4/letter/g/c0e974/32.png) [@Gisamark](https://discuss.elastic.co/u/Gisamark)\ **Post date:** [July 29, 2016, 7:05am UTC](https://discuss.elastic.co/t/no-communication-between-filebeat-and-logstash/56317/9 "2016-07-29T07:05:19Z")
**Filebeat server** /etc/filebeat/filebeat.yml ``` filebeat: prospectors: - paths: - "/var/log/secure" - "/var/log/messages" - "/var/log/*.log" input_type: log document_type: syslog registry_file: /var/lib/filebeat/registry output: logstash: # The Logstash hosts hosts: ["192.168.2.80:5044"] bulk_max_size: 1024 # Optional TLS. By default is off. tls: # List of root certificates for HTTPS server verifications certificate_authorities: ["/etc/pki/tls/certs/logstash-forwarder.crt"] ############################# Shipper ######################################### shipper: ############################# Logging ######################################### logging: # To enable logging to files, to_files option has to be set to true files: # Configure log file size limit. If limit is reached, log file will be # automatically rotated rotateeverybytes: 10485760 # = 10MB ``` **ELK Server** /etc/logstash/conf.d/02-beats-input.conf ``` input { beats { port => 5044 ssl => true ssl_certificate => "/etc/pki/tls/certs/logstash-forwarder.crt" ssl_key => "/etc/pki/tls/private/logstash-forwarder.key" } } ``` ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [July 29, 2016, 11:55am UTC](https://discuss.elastic.co/t/no-communication-between-filebeat-and-logstash/56317/10 "2016-07-29T11:55:04Z")
can you try without TLS first? Check your certificate still being valid. I remember EOF being returned by the networking libs, if certificate has been expired. ---
**Author:** ![Gisamark](https://avatars.discourse-cdn.com/v4/letter/g/c0e974/32.png) [@Gisamark](https://discuss.elastic.co/u/Gisamark)\ **Post date:** [July 29, 2016, 3:31pm UTC](https://discuss.elastic.co/t/no-communication-between-filebeat-and-logstash/56317/11 "2016-07-29T15:31:09Z")
I tried without TLS and re-installed ELK according to elastic guide. Now it works ! I'm not sure what happened, i will go without SSL for now. I suggest users to follow the Elastic guides. Thank you steffens and andrewkroh for your help ! 🙂 ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 15, 2016, 4:20pm UTC](https://discuss.elastic.co/t/no-communication-between-filebeat-and-logstash/56317/12 "2016-08-15T16:20:33Z")
This topic was automatically closed after 21 days. New replies are no longer allowed.