Send log records with Filebeat over TCP

[AClerk]

Is there a way to send filebeats output to a TCP socket?
I have tried using output.logstash
As written - The Logstash output sends events directly to Logstash by using the lumberjack protocol, which runs over TCP.
But it seems not to be working.

Any other suggestions? Solutions?

Cheers!

[warkolm (Mark Walkom)]

@AClerk

But it seems not to be working.

Elaborating on this comment might help determine the issue?

[AClerk]

@warkolm

Elaborating on this comment might help determine the issue?

I am getting errors like

2020-12-22T15:33:06.719+1100	DEBUG	[transport]	transport/client.go:205	handle error: read tcp <source_ip>:54734-><destination_ip>:514: i/o timeout

2020-12-22T15:33:06.719+1100	ERROR	[logstash]	logstash/async.go:280	Failed to publish events caused by: read tcp <source_ip>:54734-><destination_ip>:514: i/o timeout

2020-12-22T15:33:06.720+1100	ERROR	[logstash]	logstash/async.go:280	Failed to publish events caused by: client is not connected

Thanks

[warkolm (Mark Walkom)]

Looks like it's not connected then. Can you telnet to the Logstash host on that port?

[AClerk]

@warkolm

Can you telnet to the Logstash host on that port?

Yes.
telnet connection is working.

Any other configurations I might be missing?

I can see messages in the filebeat logs that connection established

2020-12-23T10:27:49.956+1100    INFO    [publisher_pipeline_output]     pipeline/output.go:151  Connection to backoff(async(tcp://<dest_ip>:514)) established