# \[Solved\] Logstash does not work with beats

**URL:** <https://discuss.elastic.co/t/solved-logstash-does-not-work-with-beats/52422>\
**Category:** Logstash\
**Created:** [June 10, 2016, 8:47am UTC](https://discuss.elastic.co/t/solved-logstash-does-not-work-with-beats/52422 "2016-06-10T08:47:13Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![bibl2008](https://avatars.discourse-cdn.com/v4/letter/b/c4cdca/32.png) [@bibl2008](https://discuss.elastic.co/u/bibl2008)\
**Post date:** [June 10, 2016, 8:47am UTC](https://discuss.elastic.co/t/solved-logstash-does-not-work-with-beats/52422/1 "2016-06-10T08:47:13Z")

</div>

Hello,

1. I installed the Logstash logstash-2.3.2-1.noarch.rpm to CentOS.

2. Changed the config:  
input {  
beats {  
port =\> 5044  
}  
}  
output {  
elasticsearch {  
hosts =\> "[srvis074.rccf.ru:9200](http://srvis074.rccf.ru:9200)"  
manage\_template =\> false  
index =\> "%{[@metadata][beat]}-%{+YYYY.MM.dd}"  
document\_type =\> "%{[@metadata][type]}"  
}  
}

3. tested config:  
[root@server bin]# ./logstash -f config.conf -t  
Configuration OK

4. Check installed beats plugin:  
[root@server bin]# ./logstash-plugin list | grep beats  
logstash-input-beats

5. Started the logstash service:  
[root@server bin]# service logstash status  
logstash is running

But winlogbeats cannot connect to server:5044:  
2016/06/10 08:41:36.480268 single.go:152: INFO send fail  
2016/06/10 08:41:36.480268 single.go:159: INFO backoff retry: 1m0s  
2016/06/10 08:42:37.475388 single.go:126: INFO Connecting error publishing events (retrying): dial tcp server:504  
4: connectex: No connection could be made because the target machine actively refused it.  
2016/06/10 08:42:37.476364 single.go:152: INFO send fail  
2016/06/10 08:42:37.477341 single.go:159: INFO backoff retry: 1m0s  
2016/06/10 08:43:38.472460 single.go:126: INFO Connecting error publishing events (retrying): dial tcp server:504  
4: connectex: No connection could be made because the target machine actively refused it.  
2016/06/10 08:43:38.474413 single.go:152: INFO send fail  
2016/06/10 08:43:38.474413 single.go:159: INFO backoff retry: 1m0s

---

<div class="post-metadata">

**Author:** ![bibl2008](https://avatars.discourse-cdn.com/v4/letter/b/c4cdca/32.png) [@bibl2008](https://discuss.elastic.co/u/bibl2008)\
**Post date:** [June 10, 2016, 8:49am UTC](https://discuss.elastic.co/t/solved-logstash-does-not-work-with-beats/52422/2 "2016-06-10T08:49:22Z")

</div>

isee next in the log:  
logstash.err logstash.log logstash.stdout  
[root@server elastic]# tail /var/log/logstash/logstash.log  
{:timestamp=\>"2016-06-10T11:27:51.194000+0300", :message=\>"translation missing: en.logstash.runner.configuration.file-not-found", :level=\>:error}  
{:timestamp=\>"2016-06-10T11:30:58.097000+0300", :message=\>"translation missing: en.logstash.runner.configuration.file-not-found", :level=\>:error}  
{:timestamp=\>"2016-06-10T11:44:27.028000+0300", :message=\>"translation missing: en.logstash.runner.configuration.file-not-found", :level=\>:error}

---

<div class="post-metadata">

**Author:** ![bibl2008](https://avatars.discourse-cdn.com/v4/letter/b/c4cdca/32.png) [@bibl2008](https://discuss.elastic.co/u/bibl2008)\
**Post date:** [June 10, 2016, 8:59am UTC](https://discuss.elastic.co/t/solved-logstash-does-not-work-with-beats/52422/3 "2016-06-10T08:59:04Z")

</div>

And I see next:  
[root@server bin]# service logstash restart  
Configuration error. Not restarting. Re-run with configtest parameter for details  
[root@server bin]# ./logstash -f config.conf -t  
Configuration OK

---

<div class="post-metadata">

**Author:** ![bibl2008](https://avatars.discourse-cdn.com/v4/letter/b/c4cdca/32.png) [@bibl2008](https://discuss.elastic.co/u/bibl2008)\
**Post date:** [June 10, 2016, 9:20am UTC](https://discuss.elastic.co/t/solved-logstash-does-not-work-with-beats/52422/4 "2016-06-10T09:20:22Z")

</div>

I find the reason of issue:  
I have config in /opt/logstash/bin/ but it needed in /etc/logstash/conf.d/logstash.conf  
I copied it to /etc/logstash/conf.d/ and restart the service logstash and now it working fine

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:53am UTC](https://discuss.elastic.co/t/solved-logstash-does-not-work-with-beats/52422/5 "2017-07-06T04:53:42Z")

</div>