No connection could be made because the target machine actively refused filebeat

After starting file filebeat I encountered an error in the filebeat log file which is the
"No connection could be made because the target machine actively refused it"

Could you please explain whether you are connecting to Elasticsearch or Logstash. If Logstash, could you please share the logstash configuration, yml and Filebeat.yml

Thanks for your reply @josephjohney. I am using logstash. And from logstash, the data is sent to Elasticsearch.

Filebeat yml:

filebeat.prospectors:

- input_type: log
  paths:
    #- /var/log/*.log
    - C:\files\*.csv

output.logstash:
  # The Logstash hosts
  hosts: ["192.168.200.250:5044"]

Logstash yml:

path.data: /var/lib/logstash

path.config: /etc/logstash/conf.d

path.logs: /var/log/logstash

logstash config:

input{
 beats{
  hosts => "localhost"
  port => 5044
}
filter {
 csv {
  separator => ","

  columns => ["logtime", "computer_name", "hardware_name", "sensor_name",
  "sensor_type", "current_value", "session_min_value", "session_max_value",
  "sensor_type_unit", "team_name", "test_project", "phase", "sku", "eut"]
 }
 
}
output {
 elasticsearch {
  hosts => "192.169.200.250"
  index => "sensor%{+YYYY.MM.dd}"
 }
 stdout {
  codec => rubydebug
 }
}

Hi @jogoinar10,

Could you please try removing hosts => "localhost" from your input config.

Regards,
Joseph

What will I put in the hosts?

I tried to bind in 0.0.0.0, but still got the same error.

You need not provide that. I assume you are using the same machine for filebeat and logstash. Logstash will open the port for filebeat to access ,

Please remove the host from input conf and try.

Also please check whether your logstash pipeline is up and running.

I am using different machine for file beat and logstash.

filebeat: 192.168.200.46
logstash: 192.168.200.250
elasticsearch: 192.168.200.250

My mistake in the previous config is the

hosts => "localhost"

It must not be localhost since my filebeat is in another machine.
After I bind to 0.0.0.0, the error is still the same.

How can i check if it is running?
On the services?

I try to use netstat to check the listening ports. At first, I can see that there's a foreign port listening which is the 192.168.200.254:5400. But after a couple of minutes, it disappear. Does the logstash stops on a certain minutes of idle? thanks.

You can check the whether logstash is up using.
curl localhost:9600
if the setting is default. If you are overiding it the yml llike below you can use the ip address
http.host: 10.155.175.22
http.port : 9600

And please change your input configuration like below
input {
beats {
port => 5044
}
}

Thank you very much @josephjohney!

Everything works fine right now. I Just deleted the hosts in the input as what you've said.

Happy to help you :slight_smile:

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.