Send log records with Filebeat over TCP

Elastic Stack Beats
1

Is there a way to send filebeats output to a TCP socket?
I have tried using output.logstash
As written - The Logstash output sends events directly to Logstash by using the lumberjack protocol, which runs over TCP.
But it seems not to be working.

Any other suggestions? Solutions?

Cheers!

2

Elaborating on this comment might help determine the issue?

3

I am getting errors like

2020-12-22T15:33:06.719+1100	DEBUG	[transport]	transport/client.go:205	handle error: read tcp <source_ip>:54734-><destination_ip>:514: i/o timeout

2020-12-22T15:33:06.719+1100	ERROR	[logstash]	logstash/async.go:280	Failed to publish events caused by: read tcp <source_ip>:54734-><destination_ip>:514: i/o timeout

2020-12-22T15:33:06.720+1100	ERROR	[logstash]	logstash/async.go:280	Failed to publish events caused by: client is not connected

Thanks

4

Looks like it's not connected then. Can you telnet to the Logstash host on that port?

5

Yes.
telnet connection is working.
image

Any other configurations I might be missing?

I can see messages in the filebeat logs that connection established

2020-12-23T10:27:49.956+1100    INFO    [publisher_pipeline_output]     pipeline/output.go:151  Connection to backoff(async(tcp://<dest_ip>:514)) established
6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.