# No connection could be made because the target machine actively refused filebeat **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [July 14, 2017, 9:29am UTC](https://discuss.elastic.co/t/no-connection-could-be-made-because-the-target-machine-actively-refused-filebeat/93152 "2017-07-14T09:29:04Z")\ **Posts on this page:** 16\ **Page:** 1
**Author:** ![jogoinar10](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jogoinar10/32/20068_2.png) [@jogoinar10](https://discuss.elastic.co/u/jogoinar10)\ **Post date:** [July 14, 2017, 9:29am UTC](https://discuss.elastic.co/t/no-connection-could-be-made-because-the-target-machine-actively-refused-filebeat/93152/1 "2017-07-14T09:29:04Z")
After starting file filebeat I encountered an error in the filebeat log file which is the "No connection could be made because the target machine actively refused it" ---
**Author:** ![josephjohney](https://avatars.discourse-cdn.com/v4/letter/j/eada6e/32.png) [@josephjohney](https://discuss.elastic.co/u/josephjohney)\ **Post date:** [July 17, 2017, 2:20pm UTC](https://discuss.elastic.co/t/no-connection-could-be-made-because-the-target-machine-actively-refused-filebeat/93152/2 "2017-07-17T14:20:49Z")
Could you please explain whether you are connecting to Elasticsearch or Logstash. If Logstash, could you please share the logstash configuration, yml and Filebeat.yml ---
**Author:** ![jogoinar10](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jogoinar10/32/20068_2.png) [@jogoinar10](https://discuss.elastic.co/u/jogoinar10)\ **Post date:** [July 18, 2017, 2:05am UTC](https://discuss.elastic.co/t/no-connection-could-be-made-because-the-target-machine-actively-refused-filebeat/93152/3 "2017-07-18T02:05:30Z")
Thanks for your reply @josephjohney. I am using logstash. And from logstash, the data is sent to Elasticsearch. ---
**Author:** ![jogoinar10](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jogoinar10/32/20068_2.png) [@jogoinar10](https://discuss.elastic.co/u/jogoinar10)\ **Post date:** [July 18, 2017, 3:13am UTC](https://discuss.elastic.co/t/no-connection-could-be-made-because-the-target-machine-actively-refused-filebeat/93152/4 "2017-07-18T03:13:31Z")
Filebeat yml: ``` filebeat.prospectors: - input_type: log paths: #- /var/log/*.log - C:\files\*.csv output.logstash: # The Logstash hosts hosts: ["192.168.200.250:5044"] ``` Logstash yml: ``` path.data: /var/lib/logstash path.config: /etc/logstash/conf.d path.logs: /var/log/logstash ``` logstash config: ``` input{ beats{ hosts => "localhost" port => 5044 } filter { csv { separator => "," columns => ["logtime", "computer_name", "hardware_name", "sensor_name", "sensor_type", "current_value", "session_min_value", "session_max_value", "sensor_type_unit", "team_name", "test_project", "phase", "sku", "eut"] } } output { elasticsearch { hosts => "192.169.200.250" index => "sensor%{+YYYY.MM.dd}" } stdout { codec => rubydebug } } ``` ---
**Author:** ![josephjohney](https://avatars.discourse-cdn.com/v4/letter/j/eada6e/32.png) [@josephjohney](https://discuss.elastic.co/u/josephjohney)\ **Post date:** [July 18, 2017, 4:01am UTC](https://discuss.elastic.co/t/no-connection-could-be-made-because-the-target-machine-actively-refused-filebeat/93152/5 "2017-07-18T04:01:34Z")
> [@jogoinar10](#): > > hosts =\> "localhost" Hi @jogoinar10, Could you please try removing hosts =\> "localhost" from your input config. Regards, Joseph ---
**Author:** ![jogoinar10](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jogoinar10/32/20068_2.png) [@jogoinar10](https://discuss.elastic.co/u/jogoinar10)\ **Post date:** [July 18, 2017, 4:13am UTC](https://discuss.elastic.co/t/no-connection-could-be-made-because-the-target-machine-actively-refused-filebeat/93152/6 "2017-07-18T04:13:47Z")
What will I put in the hosts? ---
**Author:** ![jogoinar10](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jogoinar10/32/20068_2.png) [@jogoinar10](https://discuss.elastic.co/u/jogoinar10)\ **Post date:** [July 18, 2017, 4:20am UTC](https://discuss.elastic.co/t/no-connection-could-be-made-because-the-target-machine-actively-refused-filebeat/93152/7 "2017-07-18T04:20:55Z")
I tried to bind in 0.0.0.0, but still got the same error. ---
**Author:** ![josephjohney](https://avatars.discourse-cdn.com/v4/letter/j/eada6e/32.png) [@josephjohney](https://discuss.elastic.co/u/josephjohney)\ **Post date:** [July 18, 2017, 4:23am UTC](https://discuss.elastic.co/t/no-connection-could-be-made-because-the-target-machine-actively-refused-filebeat/93152/8 "2017-07-18T04:23:01Z")
You need not provide that. I assume you are using the same machine for filebeat and logstash. Logstash will open the port for filebeat to access , Please remove the host from input conf and try. ---
**Author:** ![josephjohney](https://avatars.discourse-cdn.com/v4/letter/j/eada6e/32.png) [@josephjohney](https://discuss.elastic.co/u/josephjohney)\ **Post date:** [July 18, 2017, 4:31am UTC](https://discuss.elastic.co/t/no-connection-could-be-made-because-the-target-machine-actively-refused-filebeat/93152/9 "2017-07-18T04:31:09Z")
Also please check whether your logstash pipeline is up and running. ---
**Author:** ![jogoinar10](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jogoinar10/32/20068_2.png) [@jogoinar10](https://discuss.elastic.co/u/jogoinar10)\ **Post date:** [July 18, 2017, 4:54am UTC](https://discuss.elastic.co/t/no-connection-could-be-made-because-the-target-machine-actively-refused-filebeat/93152/10 "2017-07-18T04:54:06Z")
I am using different machine for file beat and logstash. filebeat: 192.168.200.46 logstash: 192.168.200.250 elasticsearch: 192.168.200.250 My mistake in the previous config is the `hosts => "localhost"` It must not be localhost since my filebeat is in another machine. After I bind to 0.0.0.0, the error is still the same. ---
**Author:** ![jogoinar10](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jogoinar10/32/20068_2.png) [@jogoinar10](https://discuss.elastic.co/u/jogoinar10)\ **Post date:** [July 18, 2017, 4:54am UTC](https://discuss.elastic.co/t/no-connection-could-be-made-because-the-target-machine-actively-refused-filebeat/93152/11 "2017-07-18T04:54:22Z")
How can i check if it is running? On the services? ---
**Author:** ![jogoinar10](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jogoinar10/32/20068_2.png) [@jogoinar10](https://discuss.elastic.co/u/jogoinar10)\ **Post date:** [July 18, 2017, 5:02am UTC](https://discuss.elastic.co/t/no-connection-could-be-made-because-the-target-machine-actively-refused-filebeat/93152/12 "2017-07-18T05:02:09Z")
I try to use netstat to check the listening ports. At first, I can see that there's a foreign port listening which is the 192.168.200.254:5400. But after a couple of minutes, it disappear. Does the logstash stops on a certain minutes of idle? thanks. ---
**Author:** ![josephjohney](https://avatars.discourse-cdn.com/v4/letter/j/eada6e/32.png) [@josephjohney](https://discuss.elastic.co/u/josephjohney)\ **Post date:** [July 18, 2017, 5:31am UTC](https://discuss.elastic.co/t/no-connection-could-be-made-because-the-target-machine-actively-refused-filebeat/93152/13 "2017-07-18T05:31:25Z")
You can check the whether logstash is up using. curl localhost:9600 if the setting is default. If you are overiding it the yml llike below you can use the ip address http.host: 10.155.175.22 http.port : 9600 **And please change your input configuration like below** input { beats { port =\> 5044 } } ---
**Author:** ![jogoinar10](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jogoinar10/32/20068_2.png) [@jogoinar10](https://discuss.elastic.co/u/jogoinar10)\ **Post date:** [July 18, 2017, 6:11am UTC](https://discuss.elastic.co/t/no-connection-could-be-made-because-the-target-machine-actively-refused-filebeat/93152/14 "2017-07-18T06:11:30Z")
Thank you very much @josephjohney! Everything works fine right now. I Just deleted the hosts in the input as what you've said. ---
**Author:** ![josephjohney](https://avatars.discourse-cdn.com/v4/letter/j/eada6e/32.png) [@josephjohney](https://discuss.elastic.co/u/josephjohney)\ **Post date:** [July 18, 2017, 6:20am UTC](https://discuss.elastic.co/t/no-connection-could-be-made-because-the-target-machine-actively-refused-filebeat/93152/15 "2017-07-18T06:20:10Z")
Happy to help you 🙂 ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 15, 2017, 6:20am UTC](https://discuss.elastic.co/t/no-connection-could-be-made-because-the-target-machine-actively-refused-filebeat/93152/16 "2017-08-15T06:20:41Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.