TCP output to TCP input

(Luka Zitnik) #1

Hi everyone,

I'm learning Logstash and I've got myself into this trouble.

I want to send data from a Logstash with tcp output to another one with tcp input. I guess that should work, but even though I can see tcp packets received on the other end with tcpdump I get error messages like these:

Failed (Connection refused - Connection refused). Sleeping for 0.02
Failed (Connection refused - Connection refused). Sleeping for 0.04
Failed (Connection refused - Connection refused). Sleeping for 0.08

and they go on.

I've read about Beats, but this is not that kind of question, I don't need another solution. I would just like this to work if it can. I am interested in debugging it on my own if you would like to suggest how to do that. Thanks!

(Magnus Bäck) #2
  • Is Logstash running on the receiving machine?
  • Is it listening on the same port that the sending side is trying to contact?
  • Is there a firewall blocking the access?

(Luka Zitnik) #3

Yes, it is listening on the same port the other is sending to. I was able to stop the iptables service for a while and it doesn't make any difference.

(Luka Zitnik) #4

Or, wait a moment, I don't see it with netstat -tulpn. Isn't this:

input {
    tcp {
        port => 2514

supposed to make it listen on port 2514?

(Magnus Bäck) #5

Can you connect on the same machine? What does netstat -an | grep X say, with X being the port number?

(Luka Zitnik) #6

Yes. It says nothing. No output.

Can I check if there were some problems with starting that receiving Logstash with the setup above? How can I troubleshoot this?

(Magnus Bäck) #7

Have you looked in the Logstash log?

(Luka Zitnik) #8

I didn't. I guess they are at /var/log/logstash/ but don't know which one to look at.

(Magnus Bäck) #9

Well, there aren't that many to choose from so you can't really go wrong. Look at logstash.log.

(Luka Zitnik) #10

I couldn't find anything related. Then remembered Logstash might not have read the configuration. The change in the configuration seem to have been landed but the service hasn't been restarted. I've restarted it an I can see now port is is open with the netstat command. Thank you very much for the suggestion and for standing by! I don't get the error messages any more.

(Luka Zitnik) #11

@magnusbaeck If you don't see any value in this topic, I am OK with you removing it.

(Chris Chen) #12

I got the same issue.
Maybe you set the output side to the client and set the input side to the server, try again.

(system) #13

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.