No connection could be made because the target machine actively refused filebeat

Elastic Stack Beats
1

After starting file filebeat I encountered an error in the filebeat log file which is the
"No connection could be made because the target machine actively refused it"

2

Could you please explain whether you are connecting to Elasticsearch or Logstash. If Logstash, could you please share the logstash configuration, yml and Filebeat.yml

3

Thanks for your reply @josephjohney. I am using logstash. And from logstash, the data is sent to Elasticsearch.

4

Filebeat yml:

filebeat.prospectors:

- input_type: log
  paths:
    #- /var/log/*.log
    - C:\files\*.csv

output.logstash:
  # The Logstash hosts
  hosts: ["192.168.200.250:5044"]

Logstash yml:

path.data: /var/lib/logstash

path.config: /etc/logstash/conf.d

path.logs: /var/log/logstash

logstash config:

input{
 beats{
  hosts => "localhost"
  port => 5044
}
filter {
 csv {
  separator => ","

  columns => ["logtime", "computer_name", "hardware_name", "sensor_name",
  "sensor_type", "current_value", "session_min_value", "session_max_value",
  "sensor_type_unit", "team_name", "test_project", "phase", "sku", "eut"]
 }
 
}
output {
 elasticsearch {
  hosts => "192.169.200.250"
  index => "sensor%{+YYYY.MM.dd}"
 }
 stdout {
  codec => rubydebug
 }
}
5

Hi @jogoinar10,

Could you please try removing hosts => "localhost" from your input config.

Regards,
Joseph

6

What will I put in the hosts?

7

I tried to bind in 0.0.0.0, but still got the same error.

8

You need not provide that. I assume you are using the same machine for filebeat and logstash. Logstash will open the port for filebeat to access ,

Please remove the host from input conf and try.

9

Also please check whether your logstash pipeline is up and running.

10

I am using different machine for file beat and logstash.

filebeat: 192.168.200.46
logstash: 192.168.200.250
elasticsearch: 192.168.200.250

My mistake in the previous config is the

hosts => "localhost"

It must not be localhost since my filebeat is in another machine.
After I bind to 0.0.0.0, the error is still the same.

11

How can i check if it is running?
On the services?

12

I try to use netstat to check the listening ports. At first, I can see that there's a foreign port listening which is the 192.168.200.254:5400. But after a couple of minutes, it disappear. Does the logstash stops on a certain minutes of idle? thanks.

13

You can check the whether logstash is up using.
curl localhost:9600
if the setting is default. If you are overiding it the yml llike below you can use the ip address
http.host: 10.155.175.22
http.port : 9600

And please change your input configuration like below
input {
beats {
port => 5044
}
}

14

Thank you very much @josephjohney!

Everything works fine right now. I Just deleted the hosts in the input as what you've said.

15

Happy to help you :slight_smile:

16

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.