# Port required for filebeat agent

**URL:** https://discuss.elastic.co/t/port-required-for-filebeat-agent/132083
**Category:** Beats
**Tags:** filebeat
**Created:** [May 16, 2018, 9:39am UTC](https://discuss.elastic.co/t/port-required-for-filebeat-agent/132083 "2018-05-16T09:39:29Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![priti](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/priti/32/13828_2.png) [@priti](https://discuss.elastic.co/u/priti)
#### Post date: [May 16, 2018, 9:39am UTC](https://discuss.elastic.co/t/port-required-for-filebeat-agent/132083/1 "2018-05-16T09:39:30Z")

</div>

We have planning to deploy Filebeat agent for log monitoring but need some information.

1. If i have to transfer log data beat to logstash , which port needs to be open on application server where log present?
2. If i have to transfer log data beats to kafka , which port needs to be open on application server where log present?

---

<div class="post-metadata">

### Author: ![pierhugues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pierhugues/32/48383_2.png) [@pierhugues](https://discuss.elastic.co/u/pierhugues)
#### Post date: [May 16, 2018, 2:11pm UTC](https://discuss.elastic.co/t/port-required-for-filebeat-agent/132083/2 "2018-05-16T14:11:01Z")

</div>

1. The default port for Beats -\> LS depends on what you have configured on the beats input on the Logstash side, usually people use 5044.

2. Kafka TCP connection usually uses 9092 you might to look at the [kafka documentation](https://docs.confluent.io/current/schema-registry/docs/deployment.html)

---

<div class="post-metadata">

### Author: ![pgf](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pgf/32/47996_2.png) [@pgf](https://discuss.elastic.co/u/pgf)
#### Post date: [May 16, 2018, 6:36pm UTC](https://discuss.elastic.co/t/port-required-for-filebeat-agent/132083/3 "2018-05-16T18:36:30Z")

</div>

Priti, I think you are asking about the source ports, not the destination. The agent will open a random high port (\> 5000) on the source side (application server), then connect to port 5044 (by default) on the log stash server. Same pattern for the kafka connection: random high port -\> 9092.

---

<div class="post-metadata">

### Author: ![priti](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/priti/32/13828_2.png) [@priti](https://discuss.elastic.co/u/priti)
#### Post date: [May 17, 2018, 7:18am UTC](https://discuss.elastic.co/t/port-required-for-filebeat-agent/132083/4 "2018-05-17T07:18:37Z")

</div>

> [@pgf](#):
>
> Priti, I think you are asking about the source ports, not the destination. The agent will open a random high port (\> 5000) on the source side (application server), then connect to port 5044 (by default) on the log stash server. Same pattern for the kafka connection: random high port -\> 9092.

Thank you

---

<div class="post-metadata">

### Author: ![priti](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/priti/32/13828_2.png) [@priti](https://discuss.elastic.co/u/priti)
#### Post date: [May 17, 2018, 7:18am UTC](https://discuss.elastic.co/t/port-required-for-filebeat-agent/132083/5 "2018-05-17T07:18:47Z")

</div>

Thank you

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 14, 2018, 7:18am UTC](https://discuss.elastic.co/t/port-required-for-filebeat-agent/132083/6 "2018-06-14T07:18:49Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
