# Problems getting filebeat to connect to logstash container running in kubernetes

**URL:** <https://discuss.elastic.co/t/problems-getting-filebeat-to-connect-to-logstash-container-running-in-kubernetes/277754>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [July 5, 2021, 1:49am UTC](https://discuss.elastic.co/t/problems-getting-filebeat-to-connect-to-logstash-container-running-in-kubernetes/277754 "2021-07-05T01:49:00Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![RyanCherry](https://avatars.discourse-cdn.com/v4/letter/r/59ef9b/32.png) [@RyanCherry](https://discuss.elastic.co/u/RyanCherry)\
**Post date:** [July 5, 2021, 1:49am UTC](https://discuss.elastic.co/t/problems-getting-filebeat-to-connect-to-logstash-container-running-in-kubernetes/277754/1 "2021-07-05T01:49:00Z")

</div>

Hi there, I have used the [helm chart](https://github.com/elastic/helm-charts/tree/master/logstash) to install logstash onto my kubernetes cluster, however I am having problems getting filebeat to send logs to logstash.

Filebeat is running on a windows server as a service on that server, and previously had no issues sending to logstash running on a linux box. I need to move logstash onto kubernetes but filebeat logs keep showing the following:

```auto
2021-07-05T13:36:00.048+1200	INFO	[publisher_pipeline_output]	pipeline/output.go:143	Connecting to backoff(async(tcp://route-to-container:443))
2021-07-05T13:36:00.048+1200	INFO	[publisher]	pipeline/retry.go:219	retryer: send unwait signal to consumer
2021-07-05T13:36:00.048+1200	INFO	[publisher]	pipeline/retry.go:223 done
2021-07-05T13:36:00.049+1200	INFO	[publisher_pipeline_output]	pipeline/output.go:151	Connection to backoff(async(tcp://route-to-container:443)) established
2021-07-05T13:36:00.074+1200	ERROR	[logstash]	logstash/async.go:280	Failed to publish events caused by: EOF
2021-07-05T13:36:00.074+1200	INFO	[publisher]	pipeline/retry.go:219	retryer: send unwait signal to consumer
2021-07-05T13:36:00.075+1200	INFO	[publisher]	pipeline/retry.go:223 done
2021-07-05T13:36:00.096+1200	ERROR	[logstash]	logstash/async.go:280	Failed to publish events caused by: client is not connected
2021-07-05T13:36:00.096+1200	INFO	[publisher]	pipeline/retry.go:219	retryer: send unwait signal to consumer
2021-07-05T13:36:00.097+1200	INFO	[publisher]	pipeline/retry.go:223 done

```

filebeat.yml

```auto
output.logstash:
  hosts: ["route-to-container:443"]
  loadbalance: true
  ssl.enabled: false

```

logstash.yml

```auto
    http.host: "0.0.0.0"
    log.level: info

```

logstash.conf (pipeline)

```auto
input {
      beats {
        port => 5001
        #client_inactivity_timeout => 3600 # 1 hour
      }
    }
output {
  stdout {
    codec => json
  }
}

```

Logstash does not show any errors in the container logs, or any logs that would suggest something is failing to connect  
Connections are not being blocked by any firewalls  
Kubernetes service is configured with

```auto
  ports:
    - name: beats
      port: 5001
      protocol: TCP
      targetPort: 5001

```

route-to-container targets the beats port, and is secured via Edge

I have not been able to find any information on how to fix this so far, any help would be greatly appreciated 🙂

---

<div class="post-metadata">

**Author:** ![mtojek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mtojek/32/63863_2.png) [@mtojek](https://discuss.elastic.co/u/mtojek)\
**Post date:** [July 5, 2021, 8:31am UTC](https://discuss.elastic.co/t/problems-getting-filebeat-to-connect-to-logstash-container-running-in-kubernetes/277754/2 "2021-07-05T08:31:03Z")

</div>

That's weird indeed. Did you check connectivity from inside of the pod? curl? openssl client?

---

<div class="post-metadata">

**Author:** ![RyanCherry](https://avatars.discourse-cdn.com/v4/letter/r/59ef9b/32.png) [@RyanCherry](https://discuss.elastic.co/u/RyanCherry)\
**Post date:** [July 5, 2021, 7:59pm UTC](https://discuss.elastic.co/t/problems-getting-filebeat-to-connect-to-logstash-container-running-in-kubernetes/277754/3 "2021-07-05T19:59:16Z")

</div>

I am able to telnet from the windows server to the route I have defined in kubernetes, using port 443. From inside the logstash pod I can also curl and get a good response from the windows server.

Connectivity seems to be there for both of them

---

<div class="post-metadata">

**Author:** ![RyanCherry](https://avatars.discourse-cdn.com/v4/letter/r/59ef9b/32.png) [@RyanCherry](https://discuss.elastic.co/u/RyanCherry)\
**Post date:** [July 6, 2021, 12:48am UTC](https://discuss.elastic.co/t/problems-getting-filebeat-to-connect-to-logstash-container-running-in-kubernetes/277754/4 "2021-07-06T00:48:30Z")

</div>

I have found that I will be unable to implement this in the current state as our logstash deployment cannot receive TCP connections, only HTTP. Currently it seems there is no way to send from Filebeat to Logstash over HTTP, only TCP. Is this possible to get implemented? Are there any work arounds to this that can be recommended?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 3, 2021, 2:48am UTC](https://discuss.elastic.co/t/problems-getting-filebeat-to-connect-to-logstash-container-running-in-kubernetes/277754/5 "2021-08-03T02:48:37Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.