# TCP output to TCP input **URL:** \ **Category:** Logstash\ **Created:** [November 18, 2016, 11:45am UTC](https://discuss.elastic.co/t/tcp-output-to-tcp-input/66532 "2016-11-18T11:45:16Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![luka](https://avatars.discourse-cdn.com/v4/letter/l/a587f6/32.png) [@luka](https://discuss.elastic.co/u/luka)\ **Post date:** [November 18, 2016, 11:45am UTC](https://discuss.elastic.co/t/tcp-output-to-tcp-input/66532/1 "2016-11-18T11:45:16Z")
Hi everyone, I'm learning Logstash and I've got myself into this trouble. I want to send data from a Logstash with tcp output to another one with tcp input. I guess that should work, but even though I can see tcp packets received on the other end with tcpdump I get error messages like these: ## Failed (Connection refused - Connection refused). Sleeping for 0.02 Failed (Connection refused - Connection refused). Sleeping for 0.04 Failed (Connection refused - Connection refused). Sleeping for 0.08 and they go on. I've read about Beats, but this is not that kind of question, I don't need another solution. I would just like this to work if it can. I am interested in debugging it on my own if you would like to suggest how to do that. Thanks! ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [November 18, 2016, 12:01pm UTC](https://discuss.elastic.co/t/tcp-output-to-tcp-input/66532/2 "2016-11-18T12:01:47Z")
- Is Logstash running on the receiving machine? - Is it listening on the same port that the sending side is trying to contact? - Is there a firewall blocking the access? ---
**Author:** ![luka](https://avatars.discourse-cdn.com/v4/letter/l/a587f6/32.png) [@luka](https://discuss.elastic.co/u/luka)\ **Post date:** [November 18, 2016, 1:11pm UTC](https://discuss.elastic.co/t/tcp-output-to-tcp-input/66532/3 "2016-11-18T13:11:38Z")
Yes, it is listening on the same port the other is sending to. I was able to stop the iptables service for a while and it doesn't make any difference. ---
**Author:** ![luka](https://avatars.discourse-cdn.com/v4/letter/l/a587f6/32.png) [@luka](https://discuss.elastic.co/u/luka)\ **Post date:** [November 18, 2016, 1:18pm UTC](https://discuss.elastic.co/t/tcp-output-to-tcp-input/66532/4 "2016-11-18T13:18:04Z")
Or, wait a moment, I don't see it with netstat -tulpn. Isn't this: ``` input { tcp { port => 2514 } } ``` supposed to make it listen on port 2514? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [November 18, 2016, 1:20pm UTC](https://discuss.elastic.co/t/tcp-output-to-tcp-input/66532/5 "2016-11-18T13:20:25Z")
Can you connect on the same machine? What does `netstat -an | grep X` say, with X being the port number? ---
**Author:** ![luka](https://avatars.discourse-cdn.com/v4/letter/l/a587f6/32.png) [@luka](https://discuss.elastic.co/u/luka)\ **Post date:** [November 18, 2016, 1:22pm UTC](https://discuss.elastic.co/t/tcp-output-to-tcp-input/66532/6 "2016-11-18T13:22:48Z")
Yes. It says nothing. No output. Can I check if there were some problems with starting that receiving Logstash with the setup above? How can I troubleshoot this? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [November 18, 2016, 1:24pm UTC](https://discuss.elastic.co/t/tcp-output-to-tcp-input/66532/7 "2016-11-18T13:24:30Z")
Have you looked in the Logstash log? ---
**Author:** ![luka](https://avatars.discourse-cdn.com/v4/letter/l/a587f6/32.png) [@luka](https://discuss.elastic.co/u/luka)\ **Post date:** [November 18, 2016, 1:26pm UTC](https://discuss.elastic.co/t/tcp-output-to-tcp-input/66532/8 "2016-11-18T13:26:05Z")
I didn't. I guess they are at /var/log/logstash/ but don't know which one to look at. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [November 18, 2016, 1:28pm UTC](https://discuss.elastic.co/t/tcp-output-to-tcp-input/66532/9 "2016-11-18T13:28:10Z")
Well, there aren't that many to choose from so you can't really go wrong. Look at logstash.log. ---
**Author:** ![luka](https://avatars.discourse-cdn.com/v4/letter/l/a587f6/32.png) [@luka](https://discuss.elastic.co/u/luka)\ **Post date:** [November 18, 2016, 1:46pm UTC](https://discuss.elastic.co/t/tcp-output-to-tcp-input/66532/10 "2016-11-18T13:46:27Z")
I couldn't find anything related. Then remembered Logstash might not have read the configuration. The change in the configuration seem to have been landed but the service hasn't been restarted. I've restarted it an I can see now port is is open with the netstat command. Thank you very much for the suggestion and for standing by! I don't get the error messages any more. ---
**Author:** ![luka](https://avatars.discourse-cdn.com/v4/letter/l/a587f6/32.png) [@luka](https://discuss.elastic.co/u/luka)\ **Post date:** [November 18, 2016, 1:52pm UTC](https://discuss.elastic.co/t/tcp-output-to-tcp-input/66532/11 "2016-11-18T13:52:03Z")
@magnusbaeck If you don't see any value in this topic, I am OK with you removing it. ---
**Author:** ![ChrisChen](https://avatars.discourse-cdn.com/v4/letter/c/35a633/32.png) [@ChrisChen](https://discuss.elastic.co/u/ChrisChen)\ **Post date:** [November 23, 2016, 3:26am UTC](https://discuss.elastic.co/t/tcp-output-to-tcp-input/66532/12 "2016-11-23T03:26:39Z")
I got the same issue. Maybe you set the output side to the client and set the input side to the server, try again. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 21, 2016, 3:27am UTC](https://discuss.elastic.co/t/tcp-output-to-tcp-input/66532/13 "2016-12-21T03:27:08Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.