TCP output to TCP input

Elastic Stack Logstash
1

Hi everyone,

I'm learning Logstash and I've got myself into this trouble.

I want to send data from a Logstash with tcp output to another one with tcp input. I guess that should work, but even though I can see tcp packets received on the other end with tcpdump I get error messages like these:

Failed (Connection refused - Connection refused). Sleeping for 0.02
Failed (Connection refused - Connection refused). Sleeping for 0.04
Failed (Connection refused - Connection refused). Sleeping for 0.08

and they go on.

I've read about Beats, but this is not that kind of question, I don't need another solution. I would just like this to work if it can. I am interested in debugging it on my own if you would like to suggest how to do that. Thanks!

2
  • Is Logstash running on the receiving machine?
  • Is it listening on the same port that the sending side is trying to contact?
  • Is there a firewall blocking the access?
1 Like
3

Yes, it is listening on the same port the other is sending to. I was able to stop the iptables service for a while and it doesn't make any difference.

4

Or, wait a moment, I don't see it with netstat -tulpn. Isn't this:

input {
    tcp {
        port => 2514
    }
}

supposed to make it listen on port 2514?

5

Can you connect on the same machine? What does netstat -an | grep X say, with X being the port number?

1 Like
6

Yes. It says nothing. No output.

Can I check if there were some problems with starting that receiving Logstash with the setup above? How can I troubleshoot this?

7

Have you looked in the Logstash log?

8

I didn't. I guess they are at /var/log/logstash/ but don't know which one to look at.

9

Well, there aren't that many to choose from so you can't really go wrong. Look at logstash.log.

10

I couldn't find anything related. Then remembered Logstash might not have read the configuration. The change in the configuration seem to have been landed but the service hasn't been restarted. I've restarted it an I can see now port is is open with the netstat command. Thank you very much for the suggestion and for standing by! I don't get the error messages any more.

11

@magnusbaeck If you don't see any value in this topic, I am OK with you removing it.

12

I got the same issue.
Maybe you set the output side to the client and set the input side to the server, try again.

13

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.